feat: marketplace modules and isolated container management

2026-10-07 23:18:02 +02:00
parent 564f7def1c
commit 7b121fa908
68 changed files with 2560 additions and 699 deletions
--- a/apps/platform-backend/package-lock.json
+++ b/apps/platform-backend/package-lock.json
@@ -22,6 +22,7 @@
        "pg": "^8.13.0",
        "reflect-metadata": "^0.2.2",
        "rxjs": "^7.8.1",
+        "yaml": "^2.9.1",
        "zod": "^3.24.0"
      },
      "devDependencies": {
@@ -6618,9 +6619,9 @@
      "license": "MIT"
    },
    "node_modules/js-yaml": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.3.0.tgz",
-      "integrity": "sha512-muutsYr+e2+d3rTgUGslq5rxbBlUy3cJ61IsHag2QNDQV+7zXWjkUpmALIajhrlLlrgRUiymj6U3zUr/TMK84Q==",
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
      "funding": [
        {
          "type": "github",
@@ -9544,6 +9545,21 @@
      "dev": true,
      "license": "ISC"
    },
+    "node_modules/yaml": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
    "node_modules/yargs": {
      "version": "17.7.3",
      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
--- a/apps/platform-backend/package.json
+++ b/apps/platform-backend/package.json
@@ -28,6 +28,7 @@
    "pg": "^8.13.0",
    "reflect-metadata": "^0.2.2",
    "rxjs": "^7.8.1",
+    "yaml": "^2.9.1",
    "zod": "^3.24.0"
  },
  "devDependencies": {
@@ -49,5 +50,10 @@
    "ts-jest": "^29.2.5",
    "typescript": "^5.7.0",
    "typescript-eslint": "^8.0.0"
+  },
+  "overrides": {
+    "@nestjs/swagger": {
+      "js-yaml": "5.4.1"
+    }
  }
 }
--- a/apps/platform-backend/src/auth/auth.controller.ts
+++ b/apps/platform-backend/src/auth/auth.controller.ts
@@ -55,20 +55,21 @@ export class AuthController {
      ipAddress: request.ip ?? null,
    });

-    const cookieMaxAgeSeconds = this.config.security.sessionTtlMinutes * 60;
+    // Express expects cookie maxAge in milliseconds (the DB TTL is in minutes).
+    const cookieMaxAgeMs = this.config.security.sessionTtlMinutes * 60 * 1000;
    response.cookie('mpm_session', result.sessionToken, {
      httpOnly: true,
      secure: this.config.security.cookieSecure,
      sameSite: 'lax',
      path: '/',
-      maxAge: cookieMaxAgeSeconds,
+      maxAge: cookieMaxAgeMs,
    });
    response.cookie('mpm_csrf', result.session.csrfToken, {
      httpOnly: false,
      secure: this.config.security.cookieSecure,
      sameSite: 'lax',
      path: '/',
-      maxAge: cookieMaxAgeSeconds,
+      maxAge: cookieMaxAgeMs,
    });

    return { user: toAuthUserResponse(result.user) };
@@ -95,4 +96,4 @@ export class AuthController {
  async me(@CurrentUser() user: AuthUser): Promise<{ user: AuthUserResponse }> {
    return { user: toAuthUserResponse(user) };
  }
-}
+}
--- a/apps/platform-backend/src/auth/auth.service.spec.ts
+++ b/apps/platform-backend/src/auth/auth.service.spec.ts
@@ -26,6 +26,7 @@ function createConfig(overrides: Partial<AppConfig['security']> = {}): AppConfig
    },
    adminSeed: { username: 'admin', email: 'admin@example.com', password: 'password-123' },
    runtime: { modulesDir: '/data/modules', logsDir: '/data/logs' },
+    marketplace: { publicUrl: 'http://127.0.0.1:8081', tokenEncryptionKey: '', providers: {} },
  };
 }

@@ -52,7 +53,7 @@ function createUserRecord(overrides: Partial<UserRecord> = {}): UserRecord {
 class MockUserRepository {
  public findByUsernameResult: UserRecord | null = null;
  public updateLoginSuccessCalls: string[] = [];
-  public updateLoginFailureCalls: Array<{ userId: string; attempts: number; shouldLock: boolean; lockoutMinutes: number }> = [];
+  public updateLoginFailureCalls: string[] = [];

  async findByUsername(): Promise<UserRecord | null> {
    return this.findByUsernameResult;
@@ -62,8 +63,8 @@ class MockUserRepository {
    this.updateLoginSuccessCalls.push(userId);
  }

-  async updateLoginFailure(userId: string, attempts: number, shouldLock: boolean, lockoutMinutes: number): Promise<void> {
-    this.updateLoginFailureCalls.push({ userId, attempts, shouldLock, lockoutMinutes });
+  async updateLoginFailure(userId: string): Promise<void> {
+    this.updateLoginFailureCalls.push(userId);
  }
 }

@@ -158,12 +159,12 @@ describe('AuthService', () => {
      ).rejects.toThrow(UnauthorizedException);

      expect(userRepository.updateLoginFailureCalls).toEqual([
-        { userId: 'user-1', attempts: 1, shouldLock: false, lockoutMinutes: 15 },
+        'user-1',
      ]);
      expect(auditService.records.at(-1)?.action).toBe(AUDIT_ACTIONS.LOGIN_FAILED);
    });

-    it('sperrt das Konto nach Erreichen der maximalen Fehlversuche', async () => {
+    it('verhindert Loginversuche nicht durch Kontosperren', async () => {
      const passwordHash = await passwordHasher.hash('Sicheres-Passwort-1');
      userRepository.findByUsernameResult = createUserRecord({
        passwordHash,
@@ -175,9 +176,9 @@ describe('AuthService', () => {
      ).rejects.toThrow(UnauthorizedException);

      expect(userRepository.updateLoginFailureCalls).toEqual([
-        { userId: 'user-1', attempts: 3, shouldLock: true, lockoutMinutes: 15 },
+        'user-1',
      ]);
-      expect(auditService.records.at(-1)?.action).toBe(AUDIT_ACTIONS.LOGIN_LOCKED);
+      expect(auditService.records.at(-1)?.action).toBe(AUDIT_ACTIONS.LOGIN_FAILED);
    });

    it('lehnt gesperrte Benutzer ab', async () => {
@@ -187,11 +188,12 @@ describe('AuthService', () => {
        lockedUntil: new Date(Date.now() + 60_000),
      });

-      await expect(
-        authService.login({ username: 'max', password: 'Sicheres-Passwort-1', ipAddress: '127.0.0.1' },
-      )).rejects.toThrow(UnauthorizedException);
-
-      expect(auditService.records.at(-1)?.details).toEqual({ reason: 'ACCOUNT_LOCKED' });
+      const result = await authService.login({
+        username: 'max',
+        password: 'Sicheres-Passwort-1',
+        ipAddress: '127.0.0.1',
+      });
+      expect(result.user.username).toBe('max');
    });

    it('lehnt deaktivierte Benutzer ab', async () => {
@@ -226,7 +228,7 @@ describe('AuthService', () => {
      expect(auditService.records.at(-1)?.details).toEqual({ reason: 'RATE_LIMITED' });
    });

-    it('setzt das Rate-Limit-Fenster nach erfolgreichem Login zurück', async () => {
+    it('setzt das Rate-Limit-Fenster nach erfolgreichem Login nicht zurück', async () => {
      const passwordHash = await passwordHasher.hash('Sicheres-Passwort-1');
      userRepository.findByUsernameResult = createUserRecord({ passwordHash });

@@ -243,13 +245,11 @@ describe('AuthService', () => {
      });
      expect(result.user.username).toBe('max');

-      // Nach Reset ist ein neuer Login sofort wieder möglich.
-      const secondResult = await authService.login({
+      await expect(authService.login({
        username: 'max',
        password: 'Sicheres-Passwort-1',
        ipAddress: '127.0.0.1',
-      });
-      expect(secondResult.user.username).toBe('max');
+      })).rejects.toThrow('Zu viele Anmeldeversuche. Bitte später erneut versuchen.');
    });
  });

@@ -268,4 +268,4 @@ describe('AuthService', () => {
      expect(auditService.records.at(-1)?.action).toBe(AUDIT_ACTIONS.LOGOUT);
    });
  });
-});
+});
--- a/apps/platform-backend/src/auth/auth.service.ts
+++ b/apps/platform-backend/src/auth/auth.service.ts
@@ -20,7 +20,7 @@ const INVALID_CREDENTIALS_MESSAGE = 'Benutzername oder Passwort ist falsch';

 /**
 * Authentifizierungs-Logik (Domain/Application):
- * Login mit Rate Limiting, Account Lockout, Argon2id-Verifikation,
+ * Login mit IP-basiertem Rate Limiting, Argon2id-Verifikation,
 * Session-Erstellung und Audit-Logging.
 */
@Injectable()
@@ -72,32 +72,14 @@ export class AuthService {
      throw new UnauthorizedException(INVALID_CREDENTIALS_MESSAGE);
    }

-    if (user.lockedUntil && user.lockedUntil > new Date()) {
+    const passwordValid = await this.passwordHasher.verify(user.passwordHash, input.password);
+    if (!passwordValid) {
+      await this.userRepository.updateLoginFailure(user.id);
      await this.auditService.record({
        userId: user.id,
        username: user.username,
        action: 'LOGIN_FAILED',
-        details: { reason: 'ACCOUNT_LOCKED' },
-        ipAddress: input.ipAddress,
-      });
-      throw new UnauthorizedException(INVALID_CREDENTIALS_MESSAGE);
-    }
-
-    const passwordValid = await this.passwordHasher.verify(user.passwordHash, input.password);
-    if (!passwordValid) {
-      const attempts = user.failedLoginAttempts + 1;
-      const shouldLock = attempts >= security.loginMaxAttempts;
-      await this.userRepository.updateLoginFailure(
-        user.id,
-        attempts,
-        shouldLock,
-        security.loginLockoutMinutes,
-      );
-      await this.auditService.record({
-        userId: user.id,
-        username: user.username,
-        action: shouldLock ? 'LOGIN_FAILED_LOCKED' : 'LOGIN_FAILED',
-        details: { reason: 'INVALID_PASSWORD', attempts },
+        details: { reason: 'INVALID_PASSWORD' },
        ipAddress: input.ipAddress,
      });
      throw new UnauthorizedException(INVALID_CREDENTIALS_MESSAGE);
@@ -115,7 +97,6 @@ export class AuthService {
    }

    await this.userRepository.updateLoginSuccess(user.id);
-    this.rateLimiter.reset(rateLimitKey);

    const { token, data } = await this.sessionService.create(
      user.id,
@@ -151,4 +132,4 @@ export class AuthService {
      ipAddress,
    });
  }
-}
+}
--- a/apps/platform-backend/src/auth/guards/csrf.guard.ts
+++ b/apps/platform-backend/src/auth/guards/csrf.guard.ts
@@ -13,7 +13,7 @@ const STATE_CHANGING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 *
 * Requests ohne Session (z. B. Login) sind ausgenommen: Sie besitzen
 * kein Session-CSRF-Token. Das Login ist stattdessen durch Rate
- * Limiting, Account Lockout und SameSite=Lax-Cookies geschützt.
+ * Limiting und SameSite=Lax-Cookies geschützt.
 * Ungültige Sessions werden bereits vom SessionGuard mit 401 abgewiesen.
 */
@Injectable()
--- a/apps/platform-backend/src/auth/guards/session.guard.ts
+++ b/apps/platform-backend/src/auth/guards/session.guard.ts
@@ -16,13 +16,16 @@ export function extractSessionToken(request: RequestWithCookieHeader): string |
  if (!cookieHeader) {
    return null;
  }
+  let sessionToken: string | null = null;
  for (const part of cookieHeader.split(';')) {
    const [name, ...value] = part.trim().split('=');
    if (name === 'mpm_session') {
-      return decodeURIComponent(value.join('='));
+      // Browsers may send same-name cookies from an older, narrower Path
+      // before the current Path=/ cookie. The last value is the root cookie.
+      sessionToken = decodeURIComponent(value.join('='));
    }
  }
-  return null;
+  return sessionToken;
 }

 /**
@@ -79,4 +82,4 @@ export class SessionGuard implements CanActivate {
    };
    return true;
  }
-}
+}
--- a/apps/platform-backend/src/auth/rate-limiter.service.ts
+++ b/apps/platform-backend/src/auth/rate-limiter.service.ts
@@ -13,6 +13,9 @@ interface RateLimitEntry {
@Injectable()
 export class RateLimiterService {
  private readonly entries = new Map<string, RateLimitEntry>();
+  private readonly maxEntries = 10_000;
+  private readonly cleanupIntervalMs = 60_000;
+  private lastCleanupAt = 0;

  /**
   * Prüft, ob ein Request innerhalb des Limits liegt.
@@ -21,6 +24,17 @@ export class RateLimiterService {
  isAllowed(key: string, limit: number, windowMinutes: number): boolean {
    const now = Date.now();
    const windowMs = windowMinutes * 60_000;
+    if (now - this.lastCleanupAt >= this.cleanupIntervalMs) {
+      for (const [entryKey, entry] of this.entries) {
+        const recentTimestamps = entry.timestamps.filter((timestamp) => now - timestamp < windowMs);
+        if (recentTimestamps.length === 0) {
+          this.entries.delete(entryKey);
+        } else if (recentTimestamps.length !== entry.timestamps.length) {
+          this.entries.set(entryKey, { timestamps: recentTimestamps });
+        }
+      }
+      this.lastCleanupAt = now;
+    }
    const entry = this.entries.get(key) ?? { timestamps: [] };
    const recent = entry.timestamps.filter((timestamp) => now - timestamp < windowMs);

@@ -30,6 +44,10 @@ export class RateLimiterService {
    }

    recent.push(now);
+    if (!this.entries.has(key) && this.entries.size >= this.maxEntries) {
+      const oldestKey = this.entries.keys().next().value;
+      if (oldestKey !== undefined) this.entries.delete(oldestKey);
+    }
    this.entries.set(key, { timestamps: recent });
    return true;
  }
@@ -38,4 +56,4 @@ export class RateLimiterService {
  reset(key: string): void {
    this.entries.delete(key);
  }
-}
+}
--- a/apps/platform-backend/src/config/configuration.ts
+++ b/apps/platform-backend/src/config/configuration.ts
@@ -17,7 +17,9 @@ export interface SecurityConfig {
  readonly sessionTtlMinutes: number;
  readonly cookieSecure: boolean;
  readonly behindProxy: boolean;
+  /** @deprecated Account lockout was removed to prevent attacker-triggered account denial. */
  readonly loginMaxAttempts: number;
+  /** @deprecated Account lockout was removed to prevent attacker-triggered account denial. */
  readonly loginLockoutMinutes: number;
  readonly loginRateLimitAttempts: number;
  readonly loginRateLimitWindowMinutes: number;
@@ -32,6 +34,23 @@ export interface AdminSeedConfig {
 export interface RuntimeConfig {
  readonly modulesDir: string;
  readonly logsDir: string;
+  readonly moduleUidBase?: number;
+}
+
+export interface MarketplaceProviderConfig {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly baseUrl: string;
+}
+
+export interface MarketplaceConfig {
+  readonly publicUrl: string;
+  readonly tokenEncryptionKey: string;
+  readonly providers: {
+    readonly github?: MarketplaceProviderConfig;
+    readonly gitea?: MarketplaceProviderConfig;
+    readonly forgejo?: MarketplaceProviderConfig;
+  };
 }

 export interface AppConfig {
@@ -41,6 +60,7 @@ export interface AppConfig {
  readonly security: SecurityConfig;
  readonly adminSeed: AdminSeedConfig;
  readonly runtime: RuntimeConfig;
+  readonly marketplace: MarketplaceConfig;
 }

 const booleanFromString = z
@@ -63,7 +83,80 @@ const environmentSchema = z.object({
  ADMIN_EMAIL: z.string().trim().email(),
  ADMIN_PASSWORD: z.string().min(10, 'ADMIN_PASSWORD muss mindestens 10 Zeichen lang sein').max(200),
  MODULES_DIR: z.string().min(1).default('./data/modules'),
+  MODULE_DATA_DIR: z.string().min(1).default('./data/module-data'),
  LOGS_DIR: z.string().min(1).default('./data/logs'),
+  MODULE_UID_BASE: z.coerce.number().int().min(10_000).max(64_535).optional(),
+  MARKETPLACE_PUBLIC_URL: z.string().url().default('http://127.0.0.1:8081'),
+  MARKETPLACE_TOKEN_ENCRYPTION_KEY: z.string().default(''),
+  GITHUB_OAUTH_CLIENT_ID: z.string().default(''),
+  GITHUB_OAUTH_CLIENT_SECRET: z.string().default(''),
+  GITEA_BASE_URL: z.string().default(''),
+  GITEA_OAUTH_CLIENT_ID: z.string().default(''),
+  GITEA_OAUTH_CLIENT_SECRET: z.string().default(''),
+  FORGEJO_BASE_URL: z.string().default(''),
+  FORGEJO_OAUTH_CLIENT_ID: z.string().default(''),
+  FORGEJO_OAUTH_CLIENT_SECRET: z.string().default(''),
+}).superRefine((environment, context) => {
+  if (environment.NODE_ENV === 'production' && !environment.COOKIE_SECURE) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['COOKIE_SECURE'],
+      message: 'COOKIE_SECURE muss in production auf true gesetzt sein',
+    });
+  }
+  if (environment.NODE_ENV === 'production' && environment.MODULE_UID_BASE === undefined) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['MODULE_UID_BASE'],
+      message: 'MODULE_UID_BASE ist in production erforderlich, damit Module getrennte UIDs erhalten',
+    });
+  }
+  const oauthFields = [
+    environment.GITHUB_OAUTH_CLIENT_ID,
+    environment.GITHUB_OAUTH_CLIENT_SECRET,
+    environment.GITEA_BASE_URL,
+    environment.GITEA_OAUTH_CLIENT_ID,
+    environment.GITEA_OAUTH_CLIENT_SECRET,
+    environment.FORGEJO_BASE_URL,
+    environment.FORGEJO_OAUTH_CLIENT_ID,
+    environment.FORGEJO_OAUTH_CLIENT_SECRET,
+  ];
+  if (oauthFields.some(Boolean) && environment.MARKETPLACE_TOKEN_ENCRYPTION_KEY.length < 32) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['MARKETPLACE_TOKEN_ENCRYPTION_KEY'],
+      message: 'Bei aktivierten OAuth-Anbietern ist ein Schlüssel mit mindestens 32 Zeichen erforderlich',
+    });
+  }
+  for (const [provider, fields] of [
+    ['GITHUB', [environment.GITHUB_OAUTH_CLIENT_ID, environment.GITHUB_OAUTH_CLIENT_SECRET]],
+    ['GITEA', [environment.GITEA_BASE_URL, environment.GITEA_OAUTH_CLIENT_ID, environment.GITEA_OAUTH_CLIENT_SECRET]],
+    ['FORGEJO', [environment.FORGEJO_BASE_URL, environment.FORGEJO_OAUTH_CLIENT_ID, environment.FORGEJO_OAUTH_CLIENT_SECRET]],
+  ] as const) {
+    if (fields.some(Boolean) && fields.some((field) => !field)) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [`${provider}_OAUTH_CLIENT_ID`],
+        message: `OAuth-Konfiguration für ${provider} ist unvollständig`,
+      });
+    }
+  }
+  for (const [field, value] of [['GITEA_BASE_URL', environment.GITEA_BASE_URL], ['FORGEJO_BASE_URL', environment.FORGEJO_BASE_URL]] as const) {
+    if (!value) continue;
+    try {
+      const url = new URL(value);
+      if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) {
+        throw new Error('protocol');
+      }
+      if (url.username || url.password || url.search || url.hash) throw new Error('url');
+    } catch {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [field],
+        message: 'Forge-URL muss HTTPS verwenden (HTTP ist nur lokal zulässig) und darf keine Zugangsdaten enthalten',
+      });
+    }
+  }
 });

 /** Lädt und validiert die Konfiguration aus den Umgebungsvariablen. */
@@ -91,6 +184,24 @@ export function loadConfiguration(): AppConfig {
    runtime: {
      modulesDir: path.resolve(environment.MODULES_DIR),
      logsDir: path.resolve(environment.LOGS_DIR),
+      ...(environment.MODULE_UID_BASE !== undefined
+        ? { moduleUidBase: environment.MODULE_UID_BASE }
+        : {}),
+    },
+    marketplace: {
+      publicUrl: environment.MARKETPLACE_PUBLIC_URL.replace(/\/$/, ''),
+      tokenEncryptionKey: environment.MARKETPLACE_TOKEN_ENCRYPTION_KEY,
+      providers: {
+        ...(environment.GITHUB_OAUTH_CLIENT_ID && environment.GITHUB_OAUTH_CLIENT_SECRET
+          ? { github: { clientId: environment.GITHUB_OAUTH_CLIENT_ID, clientSecret: environment.GITHUB_OAUTH_CLIENT_SECRET, baseUrl: 'https://github.com' } }
+          : {}),
+        ...(environment.GITEA_BASE_URL && environment.GITEA_OAUTH_CLIENT_ID && environment.GITEA_OAUTH_CLIENT_SECRET
+          ? { gitea: { clientId: environment.GITEA_OAUTH_CLIENT_ID, clientSecret: environment.GITEA_OAUTH_CLIENT_SECRET, baseUrl: environment.GITEA_BASE_URL.replace(/\/$/, '') } }
+          : {}),
+        ...(environment.FORGEJO_BASE_URL && environment.FORGEJO_OAUTH_CLIENT_ID && environment.FORGEJO_OAUTH_CLIENT_SECRET
+          ? { forgejo: { clientId: environment.FORGEJO_OAUTH_CLIENT_ID, clientSecret: environment.FORGEJO_OAUTH_CLIENT_SECRET, baseUrl: environment.FORGEJO_BASE_URL.replace(/\/$/, '') } }
+          : {}),
+      },
    },
  };
-}
+}
--- a/apps/platform-backend/src/database/migrations/index.ts
+++ b/apps/platform-backend/src/database/migrations/index.ts
@@ -2,6 +2,12 @@ import { migration001CoreSchema } from './001-core-schema';
 import { migration002Modules } from '../../modules/migrations/002-modules';
 import { migration003ModulePermissions } from '../../modules/migrations/003-module-permissions';
 import { migration004SystemSettings } from '../../settings/migrations/004-system-settings';
+import { migration005ModulePortUnique } from '../../modules/migrations/005-module-port-unique';
+import { migration006MarketplaceConnections } from '../../modules/migrations/006-marketplace-connections';
+import { migration007MarketplaceCatalog } from '../../modules/migrations/007-marketplace-catalog';
+import { migration008MarketplaceSourceBranch } from '../../modules/migrations/008-marketplace-source-branch';
+import { migration009MarketplaceInstallations } from '../../modules/migrations/009-marketplace-installations';
+import { migration010ModuleContainers } from '../../modules/migrations/010-module-containers';

 /** Registrierte Migrationen in aufsteigender Reihenfolge. */
 export const MIGRATIONS = [
@@ -9,4 +15,10 @@ export const MIGRATIONS = [
  migration002Modules,
  migration003ModulePermissions,
  migration004SystemSettings,
-];
+  migration005ModulePortUnique,
+  migration006MarketplaceConnections,
+  migration007MarketplaceCatalog,
+  migration008MarketplaceSourceBranch,
+  migration009MarketplaceInstallations,
+  migration010ModuleContainers,
+];
--- a/apps/platform-backend/src/main.ts
+++ b/apps/platform-backend/src/main.ts
@@ -4,6 +4,7 @@ import { NestExpressApplication } from '@nestjs/platform-express';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import cookieParser from 'cookie-parser';
 import helmet from 'helmet';
+import type { NextFunction, Request, Response } from 'express';
 import { AppModule } from './app.module';
 import { AllExceptionsFilter } from './common/filters/all-exceptions.filter';
 import { loadConfiguration } from './config/config.tokens';
@@ -26,6 +27,10 @@ async function bootstrap(): Promise<void> {

  app.use(helmet());
  app.use(cookieParser());
+  app.use('/api', (_request: Request, response: Response, next: NextFunction) => {
+    response.setHeader('Cache-Control', 'no-store');
+    next();
+  });

  if (config.security.behindProxy) {
    app.set('trust proxy', 1);
@@ -46,4 +51,4 @@ async function bootstrap(): Promise<void> {
  logger.log(`Management-Backend läuft auf Port ${config.port}`);
 }

-void bootstrap();
+void bootstrap();
--- a/apps/platform-backend/src/modules/manifest.types.ts
+++ b/apps/platform-backend/src/modules/manifest.types.ts
@@ -52,6 +52,8 @@ export const moduleManifestSchema = z.object({
    .max(MODULE_PORT_MAX, `Port muss zwischen ${MODULE_PORT_MIN} und ${MODULE_PORT_MAX} liegen`),
  healthcheck: z.string().regex(/^\/[A-Za-z0-9\-./]*$/, 'Healthcheck muss ein Pfad sein'),
  apiVersion: z.literal('v1'),
+  composeFile: z.string().min(1).max(200).optional(),
+  appService: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,62}$/).optional(),
 });
 export type ModuleManifest = z.infer<typeof moduleManifestSchema>;

@@ -71,4 +73,6 @@ export interface ModuleRecord {
  readonly enabled: boolean;
  readonly createdAt: Date;
  readonly updatedAt: Date;
-}
+  readonly composeFile?: string | null;
+  readonly appService?: string | null;
+}
--- a/apps/platform-backend/src/modules/marketplace.controller.ts
+++ b/apps/platform-backend/src/modules/marketplace.controller.ts
@@ -0,0 +1,123 @@
+import { BadRequestException, Controller, Delete, Get, Param, Post, Query, Req, Res } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { ApiTags } from '@nestjs/swagger';
+import { CurrentUser } from '../common/decorators/current-user.decorator';
+import { Public } from '../common/decorators/public.decorator';
+import { Roles } from '../common/decorators/roles.decorator';
+import type { AuthUser } from '../users/user.types';
+import { SessionService } from '../auth/session.service';
+import type { AuthenticatedRequest } from '../auth/authenticated-request';
+import { MarketplaceService } from './marketplace.service';
+import { ModulesService } from './modules.service';
+
+@ApiTags('Marketplace')
+@Controller({ path: 'api/v1/marketplace' })
+export class MarketplaceController {
+  constructor(
+    private readonly marketplaceService: MarketplaceService,
+    private readonly sessionService: SessionService,
+    private readonly modulesService: ModulesService,
+  ) {}
+
+  @Get('providers')
+  @Roles('ADMIN')
+  providers(): Promise<Awaited<ReturnType<MarketplaceService['providers']>>> {
+    return this.marketplaceService.providers();
+  }
+
+  @Get('repositories/:provider')
+  @Roles('ADMIN')
+  repositories(@Param('provider') provider: string): ReturnType<MarketplaceService['repositories']> {
+    return this.marketplaceService.repositories(provider);
+  }
+
+  @Post('repositories/:provider/:owner/:repository/install')
+  @Roles('ADMIN')
+  async installRepository(
+    @Param('provider') provider: string,
+    @Param('owner') owner: string,
+    @Param('repository') repository: string,
+    @CurrentUser() actor: AuthUser,
+    @Req() request: AuthenticatedRequest,
+  ): Promise<{ module: {
+    id: string; moduleId: string; name: string; slug: string; version: string; description: string;
+    author: string; status: string; internalPort: number; healthcheckUrl: string; enabled: boolean; createdAt: string;
+  } }> {
+    const archive = await this.marketplaceService.downloadRepositoryArchive(provider, owner, repository);
+    const manifest = await this.modulesService.validatePackage(archive);
+    const module = await this.modulesService.findByModuleId(manifest.id) ??
+      await this.modulesService.install(archive, actor, request.ip ?? null);
+    await this.marketplaceService.recordInstallation(provider, owner, repository, module.id);
+    return {
+      module: {
+        id: module.id,
+        moduleId: module.moduleId,
+        name: module.name,
+        slug: module.slug,
+        version: module.version,
+        description: module.description,
+        author: module.author,
+        status: module.status,
+        internalPort: module.internalPort,
+        healthcheckUrl: module.healthcheckUrl,
+        enabled: module.enabled,
+        createdAt: module.createdAt.toISOString(),
+      },
+    };
+  }
+
+  @Post('connections/:provider/start')
+  @Roles('ADMIN')
+  async startConnection(
+    @Param('provider') provider: string,
+    @CurrentUser() user: AuthUser,
+    @Req() request: AuthenticatedRequest,
+  ): Promise<{ authorizationUrl: string }> {
+    if (!request.session?.id) throw new BadRequestException('Session konnte nicht geprüft werden');
+    return { authorizationUrl: await this.marketplaceService.beginConnection(provider, user.id, request.session.id) };
+  }
+
+  @Delete('connections/:provider')
+  @Roles('ADMIN')
+  async disconnect(@Param('provider') provider: string): Promise<{ success: true }> {
+    await this.marketplaceService.disconnect(provider);
+    return { success: true };
+  }
+
+  @Get('oauth/:provider/callback')
+  @Public()
+  async callback(
+    @Param('provider') provider: string,
+    @Query('code') code: string | undefined,
+    @Query('state') state: string | undefined,
+    @Query('error') error: string | undefined,
+    @Req() request: Request,
+    @Res() response: Response,
+  ): Promise<void> {
+    const destination = new URL('/admin/modules', this.marketplaceService.frontendUrl());
+    if (error) {
+      destination.searchParams.set('marketplace', 'denied');
+    } else if (!code || !state) {
+      destination.searchParams.set('marketplace', 'error');
+      destination.searchParams.set('reason', 'callback');
+    } else {
+      try {
+        const token = request.cookies?.mpm_session as string | undefined;
+        const session = token ? await this.sessionService.findValid(token) : null;
+        if (!session) {
+          destination.searchParams.set('marketplace', 'error');
+          destination.searchParams.set('reason', 'session');
+          response.redirect(302, destination.toString());
+          return;
+        }
+        await this.marketplaceService.completeConnection(provider, code, state, session?.id ?? null);
+        destination.searchParams.set('marketplace', 'connected');
+        destination.searchParams.set('provider', provider);
+      } catch {
+        destination.searchParams.set('marketplace', 'error');
+        destination.searchParams.set('reason', 'oauth');
+      }
+    }
+    response.redirect(302, destination.toString());
+  }
+}
--- a/apps/platform-backend/src/modules/marketplace.service.ts
+++ b/apps/platform-backend/src/modules/marketplace.service.ts
@@ -0,0 +1,411 @@
+import {
+  BadGatewayException,
+  BadRequestException,
+  Injectable,
+  InternalServerErrorException,
+  NotFoundException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { createCipheriv, createHash, randomBytes } from 'node:crypto';
+import { APP_CONFIG, type AppConfig } from '../config/config.tokens';
+import { Inject } from '@nestjs/common';
+import { DatabaseService } from '../database/database.service';
+
+export const MARKETPLACE_PROVIDERS = ['github', 'gitea', 'forgejo'] as const;
+export type MarketplaceProvider = (typeof MARKETPLACE_PROVIDERS)[number];
+
+interface ProviderStatus {
+  provider: MarketplaceProvider;
+  label: string;
+  configured: boolean;
+  connected: boolean;
+  accountLogin: string | null;
+  baseUrl: string;
+  callbackUrl: string;
+}
+
+interface OAuthStateRow {
+  readonly provider: MarketplaceProvider;
+  readonly user_id: string;
+  readonly session_id: string;
+  readonly code_verifier: string;
+}
+
+interface ProviderIdentity {
+  readonly id: string | number;
+  readonly login?: string;
+  readonly username?: string;
+}
+
+const MAX_MARKETPLACE_DOWNLOAD = 10 * 1024 * 1024;
+
+function isProvider(value: string): value is MarketplaceProvider {
+  return MARKETPLACE_PROVIDERS.includes(value as MarketplaceProvider);
+}
+
+function safeBaseUrl(value: string): string {
+  const url = new URL(value);
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost', '::1'].includes(url.hostname))) {
+    throw new BadRequestException('Forge-URL muss HTTPS verwenden (HTTP ist nur für lokale Entwicklung erlaubt)');
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new BadRequestException('Forge-URL darf keine Zugangsdaten oder URL-Parameter enthalten');
+  }
+  return url.toString().replace(/\/$/, '');
+}
+
+@Injectable()
+export class MarketplaceService {
+  constructor(
+    private readonly database: DatabaseService,
+    @Inject(APP_CONFIG) private readonly config: AppConfig,
+  ) {}
+
+  async providers(): Promise<ProviderStatus[]> {
+    const connected = await this.database.query<{ provider: MarketplaceProvider; account_login: string }>(
+      'SELECT provider, account_login FROM marketplace_connections',
+    );
+    const connectedByProvider = new Map(connected.rows.map((row) => [row.provider, row.account_login]));
+    const labels: Record<MarketplaceProvider, string> = {
+      github: 'GitHub', gitea: 'Gitea', forgejo: 'Forgejo',
+    };
+    return MARKETPLACE_PROVIDERS.map((provider) => {
+      const configured = this.config.marketplace.providers[provider];
+      return {
+        provider,
+        label: labels[provider],
+        configured: Boolean(configured),
+        connected: connectedByProvider.has(provider),
+        accountLogin: connectedByProvider.get(provider) ?? null,
+        baseUrl: configured?.baseUrl ?? (provider === 'github' ? 'https://github.com' : ''),
+        callbackUrl: this.callbackUrl(provider),
+      };
+    });
+  }
+
+  async beginConnection(providerParam: string, userId: string, sessionId: string): Promise<string> {
+    const provider = this.requireProvider(providerParam);
+    const providerConfig = this.config.marketplace.providers[provider];
+    if (!providerConfig) {
+      throw new BadRequestException(`${provider} ist noch nicht konfiguriert`);
+    }
+    if (this.config.marketplace.tokenEncryptionKey.length < 32) {
+      throw new InternalServerErrorException('MARKETPLACE_TOKEN_ENCRYPTION_KEY muss mindestens 32 Zeichen lang sein');
+    }
+
+    const state = randomBytes(32).toString('base64url');
+    const verifier = randomBytes(48).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const callback = this.callbackUrl(provider);
+    await this.database.query(
+      `INSERT INTO marketplace_oauth_states(state_hash, provider, user_id, session_id, code_verifier, expires_at)
+       VALUES ($1, $2, $3, $4, $5, now() + interval '10 minutes')`,
+      [this.hash(state), provider, userId, sessionId, verifier],
+    );
+    await this.database.query('DELETE FROM marketplace_oauth_states WHERE expires_at < now()');
+
+    const authorizeUrl = new URL(
+      provider === 'github'
+        ? '/login/oauth/authorize'
+        : `${new URL(providerConfig.baseUrl).pathname.replace(/\/$/, '')}/login/oauth/authorize`,
+      providerConfig.baseUrl,
+    );
+    authorizeUrl.searchParams.set('client_id', providerConfig.clientId);
+    authorizeUrl.searchParams.set('redirect_uri', callback);
+    authorizeUrl.searchParams.set('response_type', 'code');
+    authorizeUrl.searchParams.set('state', state);
+    authorizeUrl.searchParams.set('code_challenge', challenge);
+    authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+    authorizeUrl.searchParams.set('scope', 'read:user');
+    return authorizeUrl.toString();
+  }
+
+  async completeConnection(providerParam: string, code: string, state: string, sessionId: string | null): Promise<void> {
+    const provider = this.requireProvider(providerParam);
+    if (!code || code.length > 4096 || !state || state.length > 256 || !sessionId) {
+      throw new BadRequestException('OAuth-Rückgabe ist ungültig');
+    }
+    const result = await this.database.query<OAuthStateRow>(
+      `DELETE FROM marketplace_oauth_states
+       WHERE state_hash = $1 AND provider = $2 AND session_id = $3 AND expires_at > now()
+       RETURNING provider, user_id, session_id, code_verifier`,
+      [this.hash(state), provider, sessionId],
+    );
+    const oauthState = result.rows[0];
+    if (!oauthState) {
+      throw new UnauthorizedException('OAuth-Status ist ungültig oder abgelaufen. Bitte erneut verbinden.');
+    }
+
+    const providerConfig = this.config.marketplace.providers[provider];
+    if (!providerConfig) throw new BadRequestException(`${provider} ist nicht konfiguriert`);
+    const callback = this.callbackUrl(provider);
+    const token = await this.exchangeCode(provider, providerConfig, code, callback, oauthState.code_verifier);
+    const identity = await this.fetchIdentity(provider, providerConfig.baseUrl, token);
+    const login = identity.login ?? identity.username;
+    if (!login || identity.id === undefined || identity.id === null) {
+      throw new BadGatewayException('Der Forge hat keine gültige Benutzeridentität zurückgegeben');
+    }
+    const encrypted = this.encryptToken(token);
+    await this.database.query(
+      `INSERT INTO marketplace_connections
+         (provider, account_id, account_login, token_ciphertext, token_iv, token_tag, connected_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (provider) DO UPDATE SET
+         account_id = EXCLUDED.account_id,
+         account_login = EXCLUDED.account_login,
+         token_ciphertext = EXCLUDED.token_ciphertext,
+         token_iv = EXCLUDED.token_iv,
+         token_tag = EXCLUDED.token_tag,
+         connected_by = EXCLUDED.connected_by,
+         connected_at = now()`,
+      [provider, String(identity.id), login, encrypted.ciphertext, encrypted.iv, encrypted.tag, oauthState.user_id],
+    );
+  }
+
+  async disconnect(providerParam: string): Promise<void> {
+    const provider = this.requireProvider(providerParam);
+    await this.database.query('DELETE FROM marketplace_connections WHERE provider = $1', [provider]);
+  }
+
+  async repositories(providerParam: string): Promise<Array<{ owner: string; repository: string; htmlUrl: string; description: string; defaultBranch: string; installed: boolean }>> {
+    const provider = this.requireProvider(providerParam);
+    const providerConfig = this.config.marketplace.providers[provider];
+    if (!providerConfig) throw new BadRequestException(`${provider} ist nicht konfiguriert`);
+    const connection = await this.database.query<{ account_login: string }>(
+      'SELECT account_login FROM marketplace_connections WHERE provider = $1', [provider],
+    );
+    const login = connection.rows[0]?.account_login;
+    if (!login) throw new BadRequestException(`${provider} ist nicht verbunden`);
+    const path = provider === 'github'
+      ? `/users/${encodeURIComponent(login)}/repos?type=owner&sort=updated&per_page=50`
+      : `${new URL(providerConfig.baseUrl).pathname.replace(/\/$/, '')}/api/v1/users/${encodeURIComponent(login)}/repos?limit=50&sort=updated`;
+    const response = await this.forgeJson<Array<Record<string, unknown>>>(provider, providerConfig.baseUrl, null, path);
+    const repositories = response.filter((repo) => repo.private !== true).map((repo) => {
+      const owner = typeof repo.owner === 'object' && repo.owner !== null
+        ? String((repo.owner as Record<string, unknown>).login ?? (repo.owner as Record<string, unknown>).username ?? login)
+        : login;
+      const repository = String(repo.name ?? '');
+      return {
+        owner,
+        repository,
+        htmlUrl: String(repo.html_url ?? ''),
+        description: String(repo.description ?? ''),
+        defaultBranch: String(repo.default_branch ?? 'main'),
+      };
+    }).filter((repo) => repo.repository && repo.htmlUrl);
+    const installed = await this.database.query<{ owner: string; repository: string }>(
+      'SELECT owner, repository FROM marketplace_module_installations WHERE provider = $1',
+      [provider],
+    );
+    const installedRepositories = new Set(installed.rows.map((row) => `${row.owner.toLowerCase()}/${row.repository.toLowerCase()}`));
+    return repositories.map((repo) => ({
+      ...repo,
+      installed: installedRepositories.has(`${repo.owner.toLowerCase()}/${repo.repository.toLowerCase()}`),
+    }));
+  }
+
+  async recordInstallation(providerParam: string, owner: string, repository: string, moduleId: string): Promise<void> {
+    const provider = this.requireProvider(providerParam);
+    await this.database.query(
+      `INSERT INTO marketplace_module_installations (provider, owner, repository, module_id)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, owner, repository) DO UPDATE SET module_id = EXCLUDED.module_id`,
+      [provider, owner, repository, moduleId],
+    );
+  }
+
+  async downloadRepositoryArchive(providerParam: string, owner: string, repository: string): Promise<Buffer> {
+    const provider = this.requireProvider(providerParam);
+    if (![owner, repository].every((part) => /^[A-Za-z0-9_.-]{1,100}$/.test(part))) {
+      throw new BadRequestException('Repository-Angabe ist ungueltig');
+    }
+    const providerConfig = this.config.marketplace.providers[provider];
+    if (!providerConfig) throw new BadRequestException('Forge-Anbieter ist nicht konfiguriert');
+    const repo = await this.forgeJson<Record<string, unknown>>(
+      provider,
+      providerConfig.baseUrl,
+      null,
+      this.repositoryApiPath(provider, owner, repository),
+    );
+    if (repo.private === true) throw new BadRequestException('Private Repositories werden aktuell nicht unterstuetzt');
+    const defaultBranch = String(repo.default_branch ?? 'main');
+    if (!defaultBranch || defaultBranch.length > 200) throw new BadRequestException('Standard-Branch ist ungueltig');
+    const archivePath = provider === 'github'
+      ? '/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repository) + '/zipball/' + encodeURIComponent(defaultBranch)
+      : new URL(providerConfig.baseUrl).pathname.replace(/[/]$/, '') + '/api/v1/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repository) + '/archive/' + encodeURIComponent(defaultBranch) + '.zip';
+    const archiveUrl = provider === 'github'
+      ? new URL(archivePath, 'https://api.github.com').toString()
+      : new URL(archivePath, providerConfig.baseUrl).toString();
+    const allowedHosts = this.downloadHosts(providerConfig.baseUrl, provider);
+    const headers: Record<string, string> = provider === 'github' ? { 'User-Agent': 'MPM-Module-Marketplace' } : {};
+    const archive = await this.downloadBounded(archiveUrl, headers, allowedHosts, MAX_MARKETPLACE_DOWNLOAD);
+    return this.normalizeRepositoryArchive(archive);
+  }
+
+  private async normalizeRepositoryArchive(archive: Buffer): Promise<Buffer> {
+    const AdmZip = (await import('adm-zip')).default;
+    const input = new AdmZip(archive);
+    const entries = input.getEntries();
+    const files = entries.filter((entry) => !entry.isDirectory);
+    if (!files.length || files.length > 2000) throw new BadRequestException('Repository-Archiv enthaelt keine gueltigen Moduldateien');
+    const firstPath = files[0].entryName;
+    const firstSlash = firstPath.indexOf('/');
+    const candidateRoot = firstSlash > 0 ? firstPath.slice(0, firstSlash) : '';
+    const hasRootManifest = files.some((entry) => entry.entryName === 'module.json');
+    const root = hasRootManifest ? '' : candidateRoot;
+    if (!root && !hasRootManifest) throw new BadRequestException('Repository-Archiv muss module.json im Stammverzeichnis enthalten');
+    let totalUncompressed = 0;
+    for (const entry of files) {
+      const name = entry.entryName;
+      if (name.includes(String.fromCharCode(92)) || name.startsWith('/') || name.split('/').includes('..')) throw new BadRequestException('Unsicherer Pfad im Repository-Archiv');
+      if (root && !name.startsWith(root + '/')) throw new BadRequestException('Repository-Archiv hat mehrere Stammverzeichnisse');
+      const unixType = (entry.header.attr >>> 16) & 0xf000;
+      if (unixType === 0xa000) throw new BadRequestException('Symlinks sind in Marketplace-Modulen nicht erlaubt');
+      totalUncompressed += entry.header.size;
+      if (totalUncompressed > 50 * 1024 * 1024) throw new BadRequestException('Repository-Archiv ist entpackt zu gross');
+    }
+    const output = new AdmZip();
+    for (const entry of files) {
+      const relative = root ? entry.entryName.slice(root.length + 1) : entry.entryName;
+      if (relative) output.addFile(relative, entry.getData());
+    }
+    const normalized = output.toBuffer();
+    if (normalized.length > MAX_MARKETPLACE_DOWNLOAD) throw new BadRequestException('Modul-Paket ueberschreitet 10 MB');
+    return normalized;
+  }
+
+  private repositoryApiPath(provider: MarketplaceProvider, owner: string, repository: string): string {
+    return provider === 'github'
+      ? `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`
+      : `${new URL(this.config.marketplace.providers[provider]!.baseUrl).pathname.replace(/\/$/, '')}/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`;
+  }
+
+  private async forgeJson<T>(provider: MarketplaceProvider, baseUrl: string, token: string | null, path: string): Promise<T> {
+    const url = provider === 'github' ? new URL(path, 'https://api.github.com') : new URL(path, baseUrl);
+    const response = await fetch(url, {
+      headers: { Accept: 'application/json', ...this.providerHeaders(provider, token) },
+      signal: AbortSignal.timeout(15_000),
+    }).catch(() => { throw new BadGatewayException('Forge-Katalog konnte nicht geladen werden'); });
+    if (!response.ok) throw new BadGatewayException('Forge-Katalog konnte nicht geladen werden');
+    return response.json() as Promise<T>;
+  }
+
+  private providerHeaders(provider: MarketplaceProvider, token: string | null): Record<string, string> {
+    return {
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(provider === 'github' ? { 'X-GitHub-Api-Version': '2022-11-28', 'User-Agent': 'MPM-Module-Marketplace' } : {}),
+    };
+  }
+
+  private downloadHosts(baseUrl: string, provider: MarketplaceProvider): string[] {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return provider === 'github' ? [host, 'api.github.com', 'codeload.github.com'] : [host];
+  }
+
+  private async downloadBounded(urlValue: string, headers: Record<string, string>, allowedHosts: string[], maxBytes: number): Promise<Buffer> {
+    let url = new URL(urlValue);
+    for (let redirects = 0; redirects <= 3; redirects += 1) {
+      if (url.protocol !== 'https:' || !allowedHosts.includes(url.hostname.toLowerCase())) throw new BadRequestException('Forge hat eine nicht vertrauenswürdige Download-Adresse geliefert');
+      const response = await fetch(url, { headers, redirect: 'manual', signal: AbortSignal.timeout(30_000) });
+      if ([301, 302, 303, 307, 308].includes(response.status)) {
+        const location = response.headers.get('location');
+        if (!location || redirects === 3) throw new BadGatewayException('Forge-Download konnte nicht aufgelöst werden');
+        url = new URL(location, url);
+        continue;
+      }
+      if (!response.ok || !response.body) throw new BadGatewayException('Forge-Download ist fehlgeschlagen');
+      const size = Number(response.headers.get('content-length') ?? 0);
+      if (size > maxBytes) throw new BadRequestException('Forge-Paket überschreitet die erlaubte Größe');
+      const reader = response.body.getReader();
+      const chunks: Buffer[] = [];
+      let total = 0;
+      while (true) {
+        const chunk = await reader.read();
+        if (chunk.done) break;
+        total += chunk.value.byteLength;
+        if (total > maxBytes) { await reader.cancel(); throw new BadRequestException('Forge-Download überschreitet die erlaubte Größe'); }
+        chunks.push(Buffer.from(chunk.value));
+      }
+      return Buffer.concat(chunks, total);
+    }
+    throw new BadGatewayException('Forge-Download konnte nicht aufgelöst werden');
+  }
+
+  callbackUrl(provider: MarketplaceProvider): string {
+    return `${this.config.marketplace.publicUrl}/api/v1/marketplace/oauth/${provider}/callback`;
+  }
+
+  frontendUrl(): string {
+    return this.config.marketplace.publicUrl;
+  }
+
+  private requireProvider(provider: string): MarketplaceProvider {
+    if (!isProvider(provider)) throw new NotFoundException('Unbekannter Forge-Anbieter');
+    return provider;
+  }
+
+  private hash(value: string | Buffer): string {
+    return createHash('sha256').update(value).digest('hex');
+  }
+
+  private encryptToken(token: string): { ciphertext: string; iv: string; tag: string } {
+    const key = createHash('sha256').update(this.config.marketplace.tokenEncryptionKey).digest();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(token, 'utf8'), cipher.final()]);
+    return {
+      ciphertext: ciphertext.toString('base64'),
+      iv: iv.toString('base64'),
+      tag: cipher.getAuthTag().toString('base64'),
+    };
+  }
+
+  private async exchangeCode(
+    provider: MarketplaceProvider,
+    config: NonNullable<AppConfig['marketplace']['providers'][MarketplaceProvider]>,
+    code: string,
+    redirectUri: string,
+    verifier: string,
+  ): Promise<string> {
+    const tokenUrl = new URL(
+      provider === 'github'
+        ? '/login/oauth/access_token'
+        : `${new URL(config.baseUrl).pathname.replace(/\/$/, '')}/login/oauth/access_token`,
+      config.baseUrl,
+    );
+    const response = await fetch(tokenUrl, {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri,
+        code_verifier: verifier,
+      }),
+      signal: AbortSignal.timeout(12_000),
+    }).catch(() => { throw new BadGatewayException('Token-Austausch beim Forge ist fehlgeschlagen'); });
+    const body = await response.json().catch(() => null) as { access_token?: unknown; error?: unknown } | null;
+    if (!response.ok || !body || typeof body.access_token !== 'string') {
+      throw new BadGatewayException('Forge hat die OAuth-Autorisierung abgelehnt');
+    }
+    return body.access_token;
+  }
+
+  private async fetchIdentity(provider: MarketplaceProvider, baseUrl: string, token: string): Promise<ProviderIdentity> {
+    const userUrl = provider === 'github'
+      ? 'https://api.github.com/user'
+      : `${safeBaseUrl(baseUrl)}/api/v1/user`;
+    const response = await fetch(userUrl, {
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+        ...(provider === 'github' ? { 'X-GitHub-Api-Version': '2022-11-28', 'User-Agent': 'MPM-Module-Marketplace' } : {}),
+      },
+      signal: AbortSignal.timeout(12_000),
+    }).catch(() => { throw new BadGatewayException('Benutzerkonto beim Forge konnte nicht gelesen werden'); });
+    if (!response.ok) throw new BadGatewayException('Benutzerkonto beim Forge konnte nicht gelesen werden');
+    return response.json() as Promise<ProviderIdentity>;
+  }
+}
--- a/apps/platform-backend/src/modules/migrations/005-module-port-unique.ts
+++ b/apps/platform-backend/src/modules/migrations/005-module-port-unique.ts
@@ -0,0 +1,12 @@
+import type { Migration } from '../../database/migration.types';
+
+/** Internal ports map to isolated module UIDs and must be unique. */
+export const migration005ModulePortUnique: Migration = {
+  id: '005-module-port-unique',
+  description: 'Eindeutige interne Modul-Ports sicherstellen',
+  up: async (client) => {
+    await client.query(
+      'CREATE UNIQUE INDEX IF NOT EXISTS idx_modules_internal_port_unique ON modules(internal_port)',
+    );
+  },
+};
--- a/apps/platform-backend/src/modules/migrations/006-marketplace-connections.ts
+++ b/apps/platform-backend/src/modules/migrations/006-marketplace-connections.ts
@@ -0,0 +1,35 @@
+import type { Migration } from '../../database/migration.types';
+
+export const migration006MarketplaceConnections: Migration = {
+  id: '006-marketplace-connections',
+  description: 'OAuth-Verbindungen für Modulquellen speichern',
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE marketplace_oauth_states (
+        state_hash TEXT PRIMARY KEY,
+        provider TEXT NOT NULL CHECK (provider IN ('github', 'gitea', 'forgejo')),
+        user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        session_id UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+        code_verifier TEXT NOT NULL,
+        expires_at TIMESTAMPTZ NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+    await client.query(`
+      CREATE INDEX idx_marketplace_oauth_states_expiry
+      ON marketplace_oauth_states(expires_at)
+    `);
+    await client.query(`
+      CREATE TABLE marketplace_connections (
+        provider TEXT PRIMARY KEY CHECK (provider IN ('github', 'gitea', 'forgejo')),
+        account_id TEXT NOT NULL,
+        account_login TEXT NOT NULL,
+        token_ciphertext TEXT NOT NULL,
+        token_iv TEXT NOT NULL,
+        token_tag TEXT NOT NULL,
+        connected_by UUID REFERENCES users(id) ON DELETE SET NULL,
+        connected_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+  },
+};
--- a/apps/platform-backend/src/modules/migrations/007-marketplace-catalog.ts
+++ b/apps/platform-backend/src/modules/migrations/007-marketplace-catalog.ts
@@ -0,0 +1,22 @@
+import type { Migration } from '../../database/migration.types';
+
+export const migration007MarketplaceCatalog: Migration = {
+  id: '007-marketplace-catalog',
+  description: 'Ausgewählte Repository-Quellen für den Modul-Marktplatz',
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE marketplace_catalog_sources (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        provider TEXT NOT NULL CHECK (provider IN ('github', 'gitea', 'forgejo')),
+        owner TEXT NOT NULL,
+        repository TEXT NOT NULL,
+        html_url TEXT NOT NULL,
+        name TEXT NOT NULL,
+        description TEXT NOT NULL DEFAULT '',
+        added_by UUID REFERENCES users(id) ON DELETE SET NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        UNIQUE (provider, owner, repository)
+      )
+    `);
+  },
+};
--- a/apps/platform-backend/src/modules/migrations/008-marketplace-source-branch.ts
+++ b/apps/platform-backend/src/modules/migrations/008-marketplace-source-branch.ts
@@ -0,0 +1,12 @@
+import type { Migration } from '../../database/migration.types';
+
+export const migration008MarketplaceSourceBranch: Migration = {
+  id: '008-marketplace-source-branch',
+  description: 'Standard-Branch für direkt installierbare Marketplace-Quellen speichern',
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE marketplace_catalog_sources
+      ADD COLUMN default_branch TEXT NOT NULL DEFAULT 'main'
+    `);
+  },
+};
--- a/apps/platform-backend/src/modules/migrations/009-marketplace-installations.ts
+++ b/apps/platform-backend/src/modules/migrations/009-marketplace-installations.ts
@@ -0,0 +1,19 @@
+import type { Migration } from '../../database/migration.types';
+
+export const migration009MarketplaceInstallations: Migration = {
+  id: '009-marketplace-installations',
+  description: 'Marketplace-Repositories installierten Modulen zuordnen',
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE marketplace_module_installations (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        provider TEXT NOT NULL CHECK (provider IN ('github', 'gitea', 'forgejo')),
+        owner TEXT NOT NULL,
+        repository TEXT NOT NULL,
+        module_id UUID NOT NULL UNIQUE REFERENCES modules(id) ON DELETE CASCADE,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        UNIQUE (provider, owner, repository)
+      )
+    `);
+  },
+};
--- a/apps/platform-backend/src/modules/migrations/010-module-containers.ts
+++ b/apps/platform-backend/src/modules/migrations/010-module-containers.ts
@@ -0,0 +1,13 @@
+import type { Migration } from '../../database/migration.types';
+
+export const migration010ModuleContainers: Migration = {
+  id: '010-module-containers',
+  description: 'Container-Compose-Konfiguration installierter Module speichern',
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE modules
+        ADD COLUMN compose_file TEXT,
+        ADD COLUMN app_service TEXT
+    `);
+  },
+};
--- a/apps/platform-backend/src/modules/module-container-manager.ts
+++ b/apps/platform-backend/src/modules/module-container-manager.ts
@@ -0,0 +1,244 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { stringify, parseDocument } from 'yaml';
+import { ModuleIdentityService } from './module-identity.service';
+import type { ModuleRecord } from './manifest.types';
+
+const SAFE_SERVICE_KEYS = new Set([
+  'image', 'build', 'command', 'entrypoint', 'environment', 'depends_on', 'volumes',
+  'healthcheck', 'working_dir', 'user', 'restart', 'expose', 'networks', 'hostname',
+  'logging', 'mem_limit', 'cpus', 'pids_limit', 'init', 'tmpfs', 'labels',
+  'stop_grace_period', 'read_only', 'tty', 'stdin_open',
+]);
+
+/** Orchestriert einen isolierten Docker-Compose-Stack für jedes Modul. */
+@Injectable()
+export class ModuleContainerManager {
+  private readonly logger = new Logger('ModuleContainers');
+  private readonly dockerHost = process.env.MODULE_DOCKER_HOST ?? 'unix:///var/run/docker.sock';
+  private readonly mpmContainer = process.env.MPM_CONTAINER_NAME ?? '';
+
+  constructor(private readonly identityService: ModuleIdentityService) {}
+
+  async start(module: ModuleRecord): Promise<void> {
+    const { composePath, overridePath, projectName, gatewayNetwork } = await this.prepare(module);
+    // Recreate stopped containers and project networks before each start. This
+    // prevents Compose v1 from trying to reconcile stale Docker Desktop network
+    // defaults after a stop; named data volumes are deliberately left untouched.
+    await this.runCompose(module.path, projectName, composePath, overridePath, ['down', '--remove-orphans']);
+    if (this.mpmContainer) await this.runDocker(['network', 'disconnect', '-f', gatewayNetwork, this.mpmContainer], true);
+    await this.runDocker(['network', 'rm', gatewayNetwork], true);
+    await this.runDocker(['network', 'create', gatewayNetwork]);
+    await this.runCompose(module.path, projectName, composePath, overridePath, ['up', '-d', '--build', '--remove-orphans']);
+    if (this.mpmContainer) {
+      await this.runDocker(['network', 'disconnect', '-f', gatewayNetwork, this.mpmContainer], true);
+      await this.runDocker(['network', 'connect', gatewayNetwork, this.mpmContainer]);
+    }
+    this.logger.log(`Container-Stack für "${module.moduleId}" gestartet`);
+  }
+
+  async stop(module: ModuleRecord): Promise<void> {
+    const { composePath, overridePath, projectName, gatewayNetwork } = await this.prepare(module);
+    await this.runCompose(module.path, projectName, composePath, overridePath, ['stop']);
+    if (this.mpmContainer) await this.runDocker(['network', 'disconnect', '-f', gatewayNetwork, this.mpmContainer], true);
+    this.logger.log(`Container-Stack für "${module.moduleId}" gestoppt`);
+  }
+
+  async remove(module: ModuleRecord): Promise<void> {
+    const { composePath, overridePath, projectName, gatewayNetwork } = await this.prepare(module);
+    if (this.mpmContainer) await this.runDocker(['network', 'disconnect', '-f', gatewayNetwork, this.mpmContainer], true);
+    // Compose down removes every app/database container and its networks. Named
+    // volumes remain, so uninstalling code does not silently destroy database data.
+    await this.runCompose(module.path, projectName, composePath, overridePath, ['down', '--remove-orphans']);
+    await this.runDocker(['network', 'rm', gatewayNetwork], true);
+    await rm(overridePath, { force: true });
+    this.logger.log(`Container für "${module.moduleId}" entfernt; Datenvolumes bleiben erhalten`);
+  }
+
+  private async prepare(module: ModuleRecord): Promise<{
+    composePath: string;
+    overridePath: string;
+    projectName: string;
+    gatewayNetwork: string;
+  }> {
+    if (!module.composeFile || !module.appService) {
+      throw new BadRequestException('Dieses Modul hat keine Docker-Compose-Konfiguration');
+    }
+    const root = path.resolve(module.path);
+    const composePath = path.resolve(root, module.composeFile);
+    if (!composePath.startsWith(root + path.sep)) throw new BadRequestException('Compose-Datei liegt außerhalb des Modulpakets');
+    const source = await readFile(composePath, 'utf8').catch(() => {
+      throw new BadRequestException(`Compose-Datei "${module.composeFile}" wurde nicht gefunden`);
+    });
+    const document = parseDocument(source, { uniqueKeys: true });
+    if (document.errors.length) throw new BadRequestException('Compose-Datei enthält ungültiges YAML');
+    const compose = document.toJS() as Record<string, unknown>;
+    this.validateCompose(compose, module);
+
+    const projectName = `mpm-${module.moduleId}`;
+    const gatewayNetwork = `mpm-module-${module.moduleId}-gateway`;
+    // Keep generated secrets outside the package/build context so Dockerfiles
+    // cannot accidentally copy them into an application image.
+    const overridePath = path.join(tmpdir(), 'mpm-compose', `${module.moduleId}.yml`);
+    const override = {
+      version: '3.8',
+      services: {
+        [module.appService]: {
+          container_name: `mpm-${module.moduleId}-app`,
+          environment: {
+            PORT: String(module.internalPort),
+            NODE_ENV: process.env.NODE_ENV ?? 'production',
+            MPM_MODULE_DATA_DIR: '/var/lib/mpm-module',
+            MPM_MODULE_IDENTITY_KEY: this.identityService.keyForModule(module.moduleId),
+          },
+          volumes: ['mpm-runtime-data:/var/lib/mpm-module'],
+          networks: {
+            default: {},
+            'mpm-gateway': { aliases: [`mpm-${module.moduleId}`] },
+          },
+          security_opt: ['no-new-privileges:true'],
+        },
+      },
+      volumes: { 'mpm-runtime-data': {} },
+      networks: { 'mpm-gateway': { external: true, name: gatewayNetwork } },
+    };
+    await mkdir(path.dirname(overridePath), { recursive: true, mode: 0o700 });
+    await writeFile(overridePath, stringify(override), { mode: 0o600 });
+    return { composePath, overridePath, projectName, gatewayNetwork };
+  }
+
+  private validateCompose(compose: Record<string, unknown>, module: ModuleRecord): void {
+    if (!compose || typeof compose !== 'object' || Array.isArray(compose)) {
+      throw new BadRequestException('Compose-Datei muss ein YAML-Objekt enthalten');
+    }
+    const topLevel = new Set(['version', 'services', 'volumes', 'networks']);
+    if (Object.keys(compose).some((key) => !topLevel.has(key))) {
+      throw new BadRequestException('Compose darf nur services, volumes und networks enthalten');
+    }
+    const services = compose.services;
+    if (!services || typeof services !== 'object' || Array.isArray(services)) {
+      throw new BadRequestException('Compose benötigt mindestens einen Service');
+    }
+    const serviceMap = services as Record<string, unknown>;
+    if (!Object.hasOwn(serviceMap, module.appService!)) {
+      throw new BadRequestException(`Compose-Service "${module.appService}" fehlt`);
+    }
+    const definedNetworks = this.record(compose.networks, 'networks');
+    const definedVolumes = this.record(compose.volumes, 'volumes');
+    if (Object.hasOwn(definedNetworks, 'mpm-gateway') || Object.hasOwn(definedVolumes, 'mpm-runtime-data')) {
+      throw new BadRequestException('Compose verwendet einen für MPM reservierten Netzwerk- oder Volume-Namen');
+    }
+    for (const [name, rawService] of Object.entries(serviceMap)) {
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,62}$/.test(name) || !rawService || typeof rawService !== 'object' || Array.isArray(rawService)) {
+        throw new BadRequestException('Compose enthält einen ungültigen Service');
+      }
+      const service = rawService as Record<string, unknown>;
+      if (Object.keys(service).some((key) => !SAFE_SERVICE_KEYS.has(key))) {
+        throw new BadRequestException(`Compose-Service "${name}" enthält nicht erlaubte Optionen`);
+      }
+      if (service.ports !== undefined || service.privileged !== undefined || service.cap_add !== undefined ||
+          service.devices !== undefined || service.network_mode !== undefined || service.pid !== undefined ||
+          service.ipc !== undefined || service.volumes_from !== undefined || service.env_file !== undefined ||
+          service.container_name !== undefined || service.secrets !== undefined || service.configs !== undefined) {
+        throw new BadRequestException(`Compose-Service "${name}" darf keine Host- oder privilegierten Ressourcen verwenden`);
+      }
+      if (service.build !== undefined) this.validateBuild(service.build, module.path);
+      if (service.volumes !== undefined) this.validateVolumes(service.volumes);
+      service.security_opt = ['no-new-privileges:true'];
+    }
+    for (const [name, volume] of Object.entries(definedVolumes)) {
+      if (name === 'mpm-runtime-data' || (volume !== undefined && volume !== null &&
+          (!volume || typeof volume !== 'object' || Array.isArray(volume) || Object.keys(volume).length > 0))) {
+        throw new BadRequestException('Compose darf nur projektlokale Datenvolumes definieren');
+      }
+    }
+    for (const [name, network] of Object.entries(definedNetworks)) {
+      const networkConfig = network && typeof network === 'object' && !Array.isArray(network)
+        ? network as Record<string, unknown>
+        : {};
+      if (name === 'mpm-gateway' || (network !== undefined && network !== null &&
+          (!network || typeof network !== 'object' || Array.isArray(network) ||
+            Object.keys(networkConfig).some((key) => !['internal', 'attachable', 'labels'].includes(key))))) {
+        throw new BadRequestException('Compose darf keine externen Netzwerke verwenden');
+      }
+    }
+  }
+
+  private record(value: unknown, label: string): Record<string, unknown> {
+    if (value === undefined) return {};
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      throw new BadRequestException(`Compose-${label} muss ein Objekt sein`);
+    }
+    return value as Record<string, unknown>;
+  }
+
+  private validateBuild(build: unknown, modulePath: string): void {
+    const context = typeof build === 'string'
+      ? build
+      : build && typeof build === 'object' && !Array.isArray(build)
+        ? String((build as Record<string, unknown>).context ?? '.')
+        : '';
+    if (!context || path.isAbsolute(context) || context.split(/[\\/]/).includes('..')) {
+      throw new BadRequestException('Build-Kontext muss innerhalb des Modulpakets liegen');
+    }
+    const resolved = path.resolve(modulePath, context);
+    if (resolved !== modulePath && !resolved.startsWith(modulePath + path.sep)) {
+      throw new BadRequestException('Build-Kontext liegt außerhalb des Modulpakets');
+    }
+  }
+
+  private validateVolumes(volumes: unknown): void {
+    if (!Array.isArray(volumes)) throw new BadRequestException('Compose-Volumes müssen als Liste angegeben werden');
+    for (const volume of volumes) {
+      if (typeof volume !== 'string') throw new BadRequestException('Compose-Volume-Angabe ist ungültig');
+      const parts = volume.split(':');
+      const [source, target, mode] = parts;
+      if (parts.length > 3 || !target || !target.startsWith('/') ||
+          (source && !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(source)) ||
+          (mode !== undefined && !/^(ro|rw)(,ro|,rw)?$/.test(mode))) {
+        throw new BadRequestException('Compose darf keine Host-Verzeichnisse mounten');
+      }
+    }
+  }
+
+  private runCompose(cwd: string, project: string, composePath: string, overridePath: string, args: string[]): Promise<void> {
+    return this.run('docker-compose', ['-p', project, '-f', composePath, '-f', overridePath, ...args], cwd);
+  }
+
+  private runDocker(args: string[], ignoreFailure = false): Promise<void> {
+    return this.run('docker', args, process.cwd(), ignoreFailure);
+  }
+
+  private run(command: string, args: string[], cwd: string, ignoreFailure = false): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const child = spawn(command, args, {
+        cwd,
+        env: {
+          PATH: process.env.PATH ?? '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+          // Do not let a root-owned /root/.docker configuration affect a child
+          // command started by the unprivileged backend user.
+          HOME: '/tmp',
+          DOCKER_HOST: this.dockerHost,
+        },
+        stdio: ['ignore', 'ignore', 'pipe'],
+      });
+      let stderr = '';
+      child.stderr.setEncoding('utf8');
+      child.stderr.on('data', (chunk: string) => { stderr = (stderr + chunk).slice(-2000); });
+      child.once('error', (error) => {
+        if (ignoreFailure) resolve();
+        else reject(new Error(`${command} konnte nicht gestartet werden: ${error.message}`));
+      });
+      child.once('close', (code) => {
+        if (code === 0 || ignoreFailure) resolve();
+        else {
+          this.logger.error(`${command} ${args[args.length - 1]} schlug mit Status ${code} fehl: ${stderr.trim()}`);
+          reject(new Error(`${command} schlug mit Status ${code} fehl`));
+        }
+      });
+    });
+  }
+}
--- a/apps/platform-backend/src/modules/module-filesystem.ts
+++ b/apps/platform-backend/src/modules/module-filesystem.ts
@@ -0,0 +1,26 @@
+import { BadRequestException } from '@nestjs/common';
+import { chmod, lstat, readdir } from 'node:fs/promises';
+import path from 'node:path';
+
+/** Make module files readable to runtime users, but never writable. */
+export async function secureModuleDirectory(directory: string): Promise<void> {
+  const rootInfo = await lstat(directory);
+  if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) {
+    throw new BadRequestException('Modulverzeichnis muss ein echtes Verzeichnis sein');
+  }
+  await chmod(directory, 0o755);
+  for (const entry of await readdir(directory)) {
+    const entryPath = path.join(directory, entry);
+    const info = await lstat(entryPath);
+    if (info.isSymbolicLink()) {
+      throw new BadRequestException(`Symbolische Links sind im Modul-Paket nicht erlaubt: ${entry}`);
+    }
+    if (info.isDirectory()) {
+      await secureModuleDirectory(entryPath);
+    } else if (info.isFile()) {
+      await chmod(entryPath, 0o644);
+    } else {
+      throw new BadRequestException(`Nicht unterstützter Dateityp im Modul-Paket: ${entry}`);
+    }
+  }
+}
--- a/apps/platform-backend/src/modules/module-gateway.middleware.ts
+++ b/apps/platform-backend/src/modules/module-gateway.middleware.ts
@@ -6,6 +6,7 @@ import { extractSessionToken } from '../auth/guards/session.guard';
 import { UserRepository } from '../users/user.repository';
 import { ModuleRepository } from './module.repository';
 import { ModulePermissionsService } from './module-permissions.service';
+import { ModuleIdentityService } from './module-identity.service';

 /** Gateway-Pfad-Präfix für interne Nginx-Weiterleitung. */
 const GATEWAY_PREFIX = '/api/v1/gateway/';
@@ -34,6 +35,7 @@ export class ModuleGatewayMiddleware implements NestMiddleware {
    private readonly sessionService: SessionService,
    private readonly userRepository: UserRepository,
    private readonly permissionsService: ModulePermissionsService,
+    private readonly identityService: ModuleIdentityService = new ModuleIdentityService(),
  ) {
    this.proxy = httpProxy.createProxyServer({
      proxyTimeout: 30_000,
@@ -52,6 +54,21 @@ export class ModuleGatewayMiddleware implements NestMiddleware {
        response.end();
      }
    });
+
+    // Nest/Express may already have consumed JSON request bodies before this
+    // middleware runs. Replay the parsed body to the module instead of leaving
+    // the proxied request stream empty (which makes module POST handlers hang).
+    this.proxy.on('proxyReq', (proxyRequest, request) => {
+      const contentType = request.headers['content-type']?.split(';', 1)[0].trim().toLowerCase();
+      const parsedBody = (request as Request).body;
+      if (contentType !== 'application/json' || parsedBody === undefined) {
+        return;
+      }
+
+      const body = JSON.stringify(parsedBody);
+      proxyRequest.setHeader('Content-Length', Buffer.byteLength(body));
+      proxyRequest.write(body);
+    });
  }

  async use(request: Request, response: Response, next: NextFunction): Promise<void> {
@@ -114,16 +131,19 @@ export class ModuleGatewayMiddleware implements NestMiddleware {
    }

    // 5. Identität sicher an das Modul übergeben (Header, nicht URL)
+    request.url = modulePath;
+    const signedIdentity = this.identityService.sign(module.moduleId, request.method, request.url, user);
    request.headers['x-user-id'] = user.id;
    request.headers['x-user-username'] = user.username;
    request.headers['x-user-display-name'] = user.displayName;
    request.headers['x-user-role'] = user.role;
+    request.headers['x-mpm-identity-timestamp'] = signedIdentity.timestamp;
+    request.headers['x-mpm-identity-signature'] = signedIdentity.signature;
    // Session-Cookie niemals an das Modul weiterleiten
    delete request.headers.cookie;

-    request.url = modulePath;
    this.proxy.web(request, response, {
-      target: `http://127.0.0.1:${module.internalPort}`,
+      target: `http://${module.composeFile && module.appService ? `mpm-${module.moduleId}` : '127.0.0.1'}:${module.internalPort}`,
    });
  }
-}
+}
--- a/apps/platform-backend/src/modules/module-health-checker.ts
+++ b/apps/platform-backend/src/modules/module-health-checker.ts
@@ -18,7 +18,8 @@ export class ModuleHealthChecker {

  /** Prüft einen Modul-Prozess über seine Healthcheck-URL. */
  async check(module: ModuleRecord): Promise<ModuleHealthResult> {
-    const url = `http://127.0.0.1:${module.internalPort}${module.healthcheckUrl}`;
+    const host = module.composeFile && module.appService ? `mpm-${module.moduleId}` : '127.0.0.1';
+    const url = `http://${host}:${module.internalPort}${module.healthcheckUrl}`;
    const start = performance.now();

    try {
@@ -40,4 +41,4 @@ export class ModuleHealthChecker {
      return { healthy: false, latencyMs, detail: `unreachable: ${detail}` };
    }
  }
-}
+}
--- a/apps/platform-backend/src/modules/module-identity.service.ts
+++ b/apps/platform-backend/src/modules/module-identity.service.ts
@@ -0,0 +1,68 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { Injectable } from '@nestjs/common';
+import type { IncomingHttpHeaders } from 'node:http';
+import type { AuthUser } from '../users/user.types';
+
+const TIMESTAMP_HEADER = 'x-mpm-identity-timestamp';
+const SIGNATURE_HEADER = 'x-mpm-identity-signature';
+const MAX_AGE_MS = 30_000;
+
+/** Issues module-specific, request-bound identities for the local module gateway. */
+@Injectable()
+export class ModuleIdentityService {
+  private readonly masterKey = randomBytes(32);
+
+  keyForModule(moduleId: string): string {
+    return createHmac('sha256', this.masterKey).update(moduleId).digest('base64url');
+  }
+
+  sign(moduleId: string, method: string, url: string, user: AuthUser): {
+    timestamp: string;
+    signature: string;
+  } {
+    const timestamp = String(Date.now());
+    return {
+      timestamp,
+      signature: this.signature(this.keyForModule(moduleId), [
+        moduleId, method, url, timestamp, user.id, user.username, user.displayName, user.role,
+      ]),
+    };
+  }
+
+  verify(
+    moduleId: string,
+    method: string,
+    url: string,
+    headers: IncomingHttpHeaders,
+    key: string,
+  ): AuthUser | null {
+    const userId = this.readHeader(headers, 'x-user-id');
+    const username = this.readHeader(headers, 'x-user-username');
+    const displayName = this.readHeader(headers, 'x-user-display-name') ?? username;
+    const role = this.readHeader(headers, 'x-user-role');
+    const timestamp = this.readHeader(headers, TIMESTAMP_HEADER);
+    const suppliedSignature = this.readHeader(headers, SIGNATURE_HEADER);
+    if (!userId || !username || !displayName || !timestamp || !suppliedSignature ||
+        (role !== 'ADMIN' && role !== 'USER')) return null;
+
+    const timestampNumber = Number(timestamp);
+    if (!Number.isSafeInteger(timestampNumber) || Math.abs(Date.now() - timestampNumber) > MAX_AGE_MS) {
+      return null;
+    }
+    const expected = Buffer.from(this.signature(key, [
+      moduleId, method, url, timestamp, userId, username, displayName, role,
+    ]), 'hex');
+    const supplied = Buffer.from(suppliedSignature, 'hex');
+    if (expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) return null;
+    return { id: userId, username, displayName, role, email: '' };
+  }
+
+  private signature(key: string, fields: readonly string[]): string {
+    return createHmac('sha256', key).update(JSON.stringify(fields)).digest('hex');
+  }
+
+  private readHeader(headers: IncomingHttpHeaders, name: string): string | null {
+    const value = headers[name];
+    return typeof value === 'string' ? value : null;
+  }
+}
--- a/apps/platform-backend/src/modules/module-installer.ts
+++ b/apps/platform-backend/src/modules/module-installer.ts
@@ -2,6 +2,7 @@ import { BadRequestException, Injectable, Logger } from '@nestjs/common';
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { moduleManifestSchema, type ModuleManifest } from './manifest.types';
+import { secureModuleDirectory } from './module-filesystem';

 /** Maximale Größe eines Modul-Pakets (10 MB). */
 const MAX_PACKAGE_SIZE_BYTES = 10 * 1024 * 1024;
@@ -64,7 +65,19 @@ export class ModuleInstaller {
      });
    }

-    return result.data;
+    const manifest = result.data;
+    if (!manifest.composeFile || !manifest.appService) {
+      throw new BadRequestException('module.json muss composeFile und appService für den Containerbetrieb enthalten');
+    }
+    if (manifest.composeFile.startsWith('/') || manifest.composeFile.includes('\\') ||
+        manifest.composeFile.split('/').includes('..')) {
+      throw new BadRequestException('composeFile muss ein relativer Pfad innerhalb des Modulpakets sein');
+    }
+    if (!zip.getEntry(manifest.composeFile)) {
+      throw new BadRequestException(`Container-Konfiguration ${manifest.composeFile} fehlt im Paket`);
+    }
+
+    return manifest;
  }

  /**
@@ -99,6 +112,7 @@ export class ModuleInstaller {
    await mkdir(directory, { recursive: true });

    zip.extractAllTo(resolvedDirectory, true);
+    await secureModuleDirectory(resolvedDirectory);

    // Paket-Metadaten für spätere Diagnose speichern.
    await writeFile(
@@ -127,4 +141,4 @@ export class ModuleInstaller {
      return null;
    }
  }
-}
+}
--- a/apps/platform-backend/src/modules/module-process-manager.ts
+++ b/apps/platform-backend/src/modules/module-process-manager.ts
@@ -1,10 +1,13 @@
 import { Injectable, Logger, type OnModuleDestroy } from '@nestjs/common';
 import { spawn, type ChildProcess } from 'node:child_process';
-import { mkdir, open } from 'node:fs/promises';
+import { chmod, chown, mkdir, open } from 'node:fs/promises';
 import path from 'node:path';
 import { APP_CONFIG, type AppConfig } from '../config/config.tokens';
 import { Inject } from '@nestjs/common';
-import type { ModuleRecord } from './manifest.types';
+import { MODULE_PORT_MIN, type ModuleRecord } from './manifest.types';
+import { secureModuleDirectory } from './module-filesystem';
+import { ModuleIdentityService } from './module-identity.service';
+import { ModuleContainerManager } from './module-container-manager';

 /** Laufende Modul-Prozesse im Speicher (nicht persistent). */
 interface RunningProcess {
@@ -27,21 +30,63 @@ interface RunningProcess {
 export class ModuleProcessManager implements OnModuleDestroy {
  private readonly logger = new Logger('ModuleProcesses');
  private readonly running = new Map<string, RunningProcess>();
+  private readonly containerModules = new Map<string, ModuleRecord>();

-  constructor(@Inject(APP_CONFIG) private readonly config: AppConfig) {}
+  constructor(
+    @Inject(APP_CONFIG) private readonly config: AppConfig,
+    private readonly identityService: ModuleIdentityService,
+    private readonly containerManager: ModuleContainerManager,
+  ) {}

  /** Startet einen Modul-Prozess. */
  async start(module: ModuleRecord): Promise<void> {
-    if (this.running.has(module.moduleId)) {
+    if (this.running.has(module.moduleId) || this.containerModules.has(module.moduleId)) {
+      return;
+    }
+
+    if (module.composeFile && module.appService) {
+      await secureModuleDirectory(module.path);
+      await this.containerManager.start(module);
+      this.containerModules.set(module.moduleId, module);
      return;
    }

    const entrypoint = path.join(module.path, 'backend', 'server.js');
    const logFilePath = path.join(this.config.runtime.logsDir, `module-${module.moduleId}.log`);
-    await mkdir(this.config.runtime.logsDir, { recursive: true });
-    const logFile = await open(logFilePath, 'a');
+    await secureModuleDirectory(module.path);
+    const moduleUid =
+      process.platform !== 'win32' && this.config.runtime.moduleUidBase !== undefined
+        ? this.config.runtime.moduleUidBase + module.internalPort - MODULE_PORT_MIN
+        : undefined;
+    const legacyDataDir = path.join(module.path, 'data');
+    await mkdir(legacyDataDir, { recursive: true, mode: 0o700 });
+    if (moduleUid !== undefined) await chown(legacyDataDir, moduleUid, moduleUid);
+    await mkdir(this.config.runtime.logsDir, { recursive: true, mode: 0o700 });
+    await chmod(this.config.runtime.logsDir, 0o700);
+    const logFile = await open(logFilePath, 'a', 0o600);
+    await chmod(logFilePath, 0o600);

-    const child = spawn(process.execPath, [entrypoint], {
+    // Unique UID/GID per internal port prevents modules from reading or tracing
+    // each other's processes. Production Compose grants only SETUID/SETGID.
+    // The platform backend receives SETUID/SETGID/KILL as ambient capabilities from
+    // supervisord. Use setpriv to change the module identity, then clear all
+    // inheritable/ambient capabilities before executing untrusted module code.
+    const moduleCommand = moduleUid !== undefined ? '/usr/bin/setpriv' : process.execPath;
+    const moduleArgs =
+      moduleUid !== undefined
+        ? [
+            `--reuid=${moduleUid}`,
+            `--regid=${moduleUid}`,
+            '--clear-groups',
+            '--inh-caps=-all',
+            '--ambient-caps=-all',
+            '--no-new-privs',
+            '--',
+            process.execPath,
+            entrypoint,
+          ]
+        : [entrypoint];
+    const child = spawn(moduleCommand, moduleArgs, {
      cwd: module.path,
      // Log-Datei bleibt offen: Der fd wird vom Kindprozess geerbt und
      // darf erst nach Prozessende geschlossen werden.
@@ -50,6 +95,8 @@ export class ModuleProcessManager implements OnModuleDestroy {
        PATH: process.env.PATH ?? '',
        NODE_ENV: this.config.nodeEnv,
        PORT: String(module.internalPort),
+        MPM_MODULE_DATA_DIR: legacyDataDir,
+        MPM_MODULE_IDENTITY_KEY: this.identityService.keyForModule(module.moduleId),
        // Modul erhält nur seinen eigenen Kontext – keine Plattform-Secrets.
      },
      detached: false,
@@ -68,6 +115,12 @@ export class ModuleProcessManager implements OnModuleDestroy {

  /** Stoppt einen Modul-Prozess (SIGTERM, dann SIGKILL). */
  async stop(moduleId: string): Promise<void> {
+    const containerModule = this.containerModules.get(moduleId);
+    if (containerModule) {
+      await this.containerManager.stop(containerModule);
+      this.containerModules.delete(moduleId);
+      return;
+    }
    const process_ = this.running.get(moduleId);
    if (!process_) {
      return;
@@ -93,6 +146,13 @@ export class ModuleProcessManager implements OnModuleDestroy {
    this.logger.log(`Modul-Prozess "${moduleId}" gestoppt`);
  }

+  async remove(module: ModuleRecord): Promise<void> {
+    if (module.composeFile && module.appService) {
+      await this.containerManager.remove(module);
+      this.containerModules.delete(module.moduleId);
+    }
+  }
+
  /** Prüft, ob ein Modul-Prozess läuft. */
  isRunning(moduleId: string): boolean {
    return this.running.has(moduleId);
@@ -100,11 +160,11 @@ export class ModuleProcessManager implements OnModuleDestroy {

  /** Stoppt alle Modul-Prozesse (Herunterfahren). */
  async stopAll(): Promise<void> {
-    const moduleIds = [...this.running.keys()];
+    const moduleIds = [...this.running.keys(), ...this.containerModules.keys()];
    await Promise.all(moduleIds.map((moduleId) => this.stop(moduleId)));
  }

  async onModuleDestroy(): Promise<void> {
    await this.stopAll();
  }
-}
+}
--- a/apps/platform-backend/src/modules/module.repository.ts
+++ b/apps/platform-backend/src/modules/module.repository.ts
@@ -17,10 +17,13 @@ interface ModuleRow {
  enabled: boolean;
  created_at: Date;
  updated_at: Date;
+  compose_file: string | null;
+  app_service: string | null;
 }

 const MODULE_COLUMNS = `id, module_id, name, slug, version, description, author, path,
-                        status, internal_port, healthcheck_url, enabled, created_at, updated_at`;
+                        status, internal_port, healthcheck_url, enabled, created_at, updated_at,
+                        compose_file, app_service`;

 /**
 * Modul-Repository (Infrastructure): Datenbankzugriffe für die Modul-Registry.
@@ -80,8 +83,9 @@ export class ModuleRepository {
  async create(manifest: ModuleManifest, directory: string): Promise<ModuleRecord> {
    const result = await this.database.query<ModuleRow>(
      `INSERT INTO modules
-         (module_id, name, slug, version, description, author, path, status, internal_port, healthcheck_url)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, 'INSTALLED', $8, $9)
+         (module_id, name, slug, version, description, author, path, status, internal_port, healthcheck_url,
+          compose_file, app_service)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, 'INSTALLED', $8, $9, $10, $11)
       RETURNING ${MODULE_COLUMNS}`,
      [
        manifest.id,
@@ -93,6 +97,8 @@ export class ModuleRepository {
        directory,
        manifest.port,
        manifest.healthcheck,
+        manifest.composeFile ?? null,
+        manifest.appService ?? null,
      ],
    );
    return this.mapRow(result.rows[0]);
@@ -132,6 +138,8 @@ export class ModuleRepository {
      enabled: row.enabled,
      createdAt: row.created_at,
      updatedAt: row.updated_at,
+      composeFile: row.compose_file,
+      appService: row.app_service,
    };
  }
-}
+}
--- a/apps/platform-backend/src/modules/modules.module.ts
+++ b/apps/platform-backend/src/modules/modules.module.ts
@@ -21,15 +21,21 @@ import { ModuleRepository } from './module.repository';
 import { ModuleStartupRecovery } from './module-startup-recovery';
 import { ModulesController } from './modules.controller';
 import { ModulesService } from './modules.service';
+import { ModuleIdentityService } from './module-identity.service';
+import { MarketplaceController } from './marketplace.controller';
+import { MarketplaceService } from './marketplace.service';
+import { ModuleContainerManager } from './module-container-manager';

 /** Modul-System: Installation, Lifecycle, Prozessverwaltung, Gateway. */
@Module({
  imports: [ConfigModule, DatabaseModule, AuditModule],
-  controllers: [ModulesController, ModulePermissionsController],
+  controllers: [ModulesController, ModulePermissionsController, MarketplaceController],
  providers: [
    ModuleRepository,
    ModuleInstaller,
    ModuleProcessManager,
+    ModuleIdentityService,
+    ModuleContainerManager,
    ModuleHealthChecker,
    ModulesService,
    SessionService,
@@ -39,6 +45,7 @@ import { ModulesService } from './modules.service';
    ModuleStartupRecovery,
    ModulePermissionRepository,
    ModulePermissionsService,
+    MarketplaceService,
  ],
  exports: [ModuleRepository, ModulesService, ModulePermissionsService, ModuleHealthChecker],
 })
@@ -49,4 +56,4 @@ export class ModulesModule implements NestModule {
      .apply(ModuleGatewayMiddleware)
      .forRoutes({ path: '/api/v1/gateway/(.*)', method: RequestMethod.ALL });
  }
-}
+}
--- a/apps/platform-backend/src/modules/modules.service.spec.ts
+++ b/apps/platform-backend/src/modules/modules.service.spec.ts
@@ -191,6 +191,7 @@ const TEST_CONFIG: AppConfig = {
  },
  adminSeed: { username: 'admin', email: 'admin@example.com', password: 'password-123' },
  runtime: { modulesDir: '/data/modules', logsDir: '/data/logs' },
+  marketplace: { publicUrl: 'http://127.0.0.1:8081', tokenEncryptionKey: '', providers: {} },
 };

 describe('ModulesService', () => {
@@ -330,4 +331,4 @@ describe('ModulesService', () => {
      expect(auditService.records.at(-1)?.action).toBe(AUDIT_ACTIONS.MODULE_REMOVED);
    });
  });
-});
+});
--- a/apps/platform-backend/src/modules/modules.service.ts
+++ b/apps/platform-backend/src/modules/modules.service.ts
@@ -88,6 +88,14 @@ export class ModulesService {
    return module;
  }

+  async validatePackage(packageBuffer: Buffer) {
+    return this.installer.validatePackage(packageBuffer);
+  }
+
+  async findByModuleId(moduleId: string): Promise<ModuleRecord | null> {
+    return this.moduleRepository.findByModuleId(moduleId);
+  }
+
  /** Startet ein Modul (INSTALLED/STOPPED → STARTING → RUNNING). */
  async start(id: string, actor: ActingUser, ipAddress: string | null): Promise<ModuleRecord> {
    const module = await this.getById(id);
@@ -210,6 +218,8 @@ export class ModulesService {
      await this.stop(id, actor, ipAddress);
    }

+    await this.processManager.remove(module);
+
    await this.moduleRepository.delete(id);
    await this.installer.remove(this.config.runtime.modulesDir, module.moduleId);

@@ -249,4 +259,4 @@ export class ModulesService {
      ipAddress,
    });
  }
-}
+}
--- a/apps/platform-backend/src/users/user.repository.ts
+++ b/apps/platform-backend/src/users/user.repository.ts
@@ -1,4 +1,4 @@
-import { Injectable } from '@nestjs/common';
+import { BadRequestException, Injectable } from '@nestjs/common';
 import { DatabaseService } from '../database/database.service';
 import { PasswordHasher } from './password-hasher';
 import type { CreateUserDto, RoleName, UpdateUserDto, UserRecord } from './user.types';
@@ -108,17 +108,41 @@ export class UserRepository {
    setClauses.push('updated_at = now()');
    params.push(id);

-    const result = await this.database.query<UserRow>(
-      `UPDATE users
-         SET ${setClauses.join(', ')}
-       WHERE id = $${parameterIndex}
-       RETURNING id, username, email, password_hash, display_name,
-                 (SELECT name FROM roles WHERE id = role_id) AS role_name,
-                 is_active, failed_login_attempts, locked_until,
-                 last_login_at, created_at, updated_at`,
-      params,
-    );
-    return this.mapRow(result.rows[0]);
+    return this.database.transaction(async (client) => {
+      await client.query('SELECT pg_advisory_xact_lock(727273)');
+      if (changes.role === 'USER' || changes.isActive === false) {
+        const current = await client.query<{ role_name: RoleName; is_active: boolean }>(
+          `SELECT r.name AS role_name, u.is_active
+             FROM users u JOIN roles r ON r.id = u.role_id
+            WHERE u.id = $1 FOR UPDATE OF u`,
+          [id],
+        );
+        if (current.rows[0]?.role_name === 'ADMIN' && current.rows[0].is_active) {
+          const count = await client.query<{ count: number }>(
+            `SELECT count(*)::int AS count
+               FROM users u JOIN roles r ON r.id = u.role_id
+              WHERE r.name = 'ADMIN' AND u.is_active`,
+          );
+          if ((count.rows[0]?.count ?? 0) <= 1) {
+            throw new BadRequestException(
+              'Der letzte aktive Administrator kann nicht herabgestuft oder deaktiviert werden',
+            );
+          }
+        }
+      }
+      const result = await client.query<UserRow>(
+        `UPDATE users
+           SET ${setClauses.join(', ')}
+         WHERE id = $${parameterIndex}
+         RETURNING id, username, email, password_hash, display_name,
+                   (SELECT name FROM roles WHERE id = role_id) AS role_name,
+                   is_active, failed_login_attempts, locked_until,
+                   last_login_at, created_at, updated_at`,
+        params,
+      );
+      if (!result.rows[0]) throw new BadRequestException('Benutzer nicht gefunden');
+      return this.mapRow(result.rows[0]);
+    });
  }

  /** Setzt einen neuen Passwort-Hash. */
@@ -138,7 +162,26 @@ export class UserRepository {
  }

  async delete(id: string): Promise<void> {
-    await this.database.query('DELETE FROM users WHERE id = $1', [id]);
+    await this.database.transaction(async (client) => {
+      await client.query('SELECT pg_advisory_xact_lock(727273)');
+      const current = await client.query<{ role_name: RoleName; is_active: boolean }>(
+        `SELECT r.name AS role_name, u.is_active
+           FROM users u JOIN roles r ON r.id = u.role_id
+          WHERE u.id = $1 FOR UPDATE OF u`,
+        [id],
+      );
+      if (current.rows[0]?.role_name === 'ADMIN' && current.rows[0].is_active) {
+        const count = await client.query<{ count: number }>(
+          `SELECT count(*)::int AS count
+             FROM users u JOIN roles r ON r.id = u.role_id
+            WHERE r.name = 'ADMIN' AND u.is_active`,
+        );
+        if ((count.rows[0]?.count ?? 0) <= 1) {
+          throw new BadRequestException('Der letzte aktive Administrator kann nicht gelöscht werden');
+        }
+      }
+      await client.query('DELETE FROM users WHERE id = $1', [id]);
+    });
  }

  /** Anzahl aktiver Administratoren (Schutz vor Verlust des letzten Admins). */
@@ -163,21 +206,13 @@ export class UserRepository {
    );
  }

-  async updateLoginFailure(
-    userId: string,
-    attempts: number,
-    shouldLock: boolean,
-    lockoutMinutes: number,
-  ): Promise<void> {
+  async updateLoginFailure(userId: string): Promise<void> {
    await this.database.query(
      `UPDATE users
-         SET failed_login_attempts = $2,
-             locked_until = CASE WHEN $3::boolean
-                                 THEN now() + make_interval(mins => $4::int)
-                                 ELSE locked_until END,
+         SET failed_login_attempts = failed_login_attempts + 1,
             updated_at = now()
       WHERE id = $1`,
-      [userId, attempts, shouldLock, lockoutMinutes],
+      [userId],
    );
  }

@@ -197,4 +232,4 @@ export class UserRepository {
      updatedAt: row.updated_at,
    };
  }
-}
+}
--- a/apps/platform-frontend/src/components/layout/app-layout.tsx
+++ b/apps/platform-frontend/src/components/layout/app-layout.tsx
@@ -1,30 +1,40 @@
-import { type ReactNode, useState } from 'react';
+import { type ReactNode, useEffect, useState } from 'react';
 import { NavLink, Outlet } from 'react-router-dom';
 import { useAuth } from '../../features/auth/auth-context';
-import { Badge } from '../ui/badge';
+import { ProfilePage } from '../../features/profile/profile-page';
+import { Icon, type IconName } from '../ui/icon';

 /** Ein Navigationspunkt der Sidebar. */
 interface NavItem {
  to: string;
  label: string;
-  icon: string;
+  icon: IconName;
  adminOnly?: boolean;
 }

 const NAV_ITEMS: NavItem[] = [
-  { to: '/', label: 'Dashboard', icon: '⌂' },
-  { to: '/profile', label: 'Mein Profil', icon: '👤' },
-  { to: '/admin/users', label: 'Benutzer', icon: '👥', adminOnly: true },
-  { to: '/admin/modules', label: 'Module', icon: '🧩', adminOnly: true },
-  { to: '/admin/system', label: 'Systemstatus', icon: '⚙', adminOnly: true },
-  { to: '/admin/audit', label: 'Audit-Log', icon: '📋', adminOnly: true },
-  { to: '/admin/settings', label: 'Einstellungen', icon: '🔧', adminOnly: true },
+  { to: '/', label: 'Dashboard', icon: 'dashboard' },
+  { to: '/admin/users', label: 'Benutzer', icon: 'users', adminOnly: true },
+  { to: '/admin/modules', label: 'Module', icon: 'modules', adminOnly: true },
+  { to: '/admin/system', label: 'Systemstatus', icon: 'system', adminOnly: true },
+  { to: '/admin/audit', label: 'Audit-Log', icon: 'audit', adminOnly: true },
 ];

+function initialDarkMode(): boolean {
+  return document.documentElement.dataset.theme === 'dark';
+}
+
 /** Responsive App-Shell: Sidebar (Desktop) / Overlay-Menü (Mobil). */
 export function AppLayout(): ReactNode {
  const { user, logout } = useAuth();
  const [mobileMenuOpen, setMobileMenuOpen] = useState(false);
+  const [profileOpen, setProfileOpen] = useState(false);
+  const [darkMode, setDarkMode] = useState(initialDarkMode);
+
+  useEffect(() => {
+    document.documentElement.dataset.theme = darkMode ? 'dark' : 'light';
+    localStorage.setItem('mpm-theme', darkMode ? 'dark' : 'light');
+  }, [darkMode]);

  const visibleItems = NAV_ITEMS.filter(
    (item) => !item.adminOnly || user?.role === 'ADMIN',
@@ -70,22 +80,28 @@ export function AppLayout(): ReactNode {
                  }`
              }
            >
-              <span aria-hidden="true">{item.icon}</span>
+              <Icon name={item.icon} className="h-[18px] w-[18px]" />
              {item.label}
            </NavLink>
          ))}
        </nav>

        <div className="border-t border-slate-200 p-4">
-          <div className="flex items-center justify-between">
-            <div className="min-w-0">
-              <p className="truncate text-sm font-medium text-slate-900">
-                {user?.displayName}
-              </p>
-              <p className="truncate text-xs text-slate-500">@{user?.username}</p>
-            </div>
-            {user?.role === 'ADMIN' && <Badge variant="info">Admin</Badge>}
-          </div>
+          <button
+            type="button"
+            onClick={() => setProfileOpen(true)}
+            className="group flex w-full min-w-0 items-center gap-3 rounded-xl border border-slate-200 bg-slate-50 px-3 py-3 text-left transition-colors hover:border-brand-300 hover:bg-brand-50"
+            aria-haspopup="dialog"
+            aria-label={`Profileinstellungen für ${user?.displayName ?? 'Benutzer'} öffnen`}
+          >
+            <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border border-slate-200 bg-white text-slate-600">
+              <Icon name="user" className="h-[18px] w-[18px]" />
+            </span>
+            <span className="min-w-0 flex-1 truncate text-sm font-medium text-slate-900 group-hover:text-brand-700">
+              {user?.displayName}
+            </span>
+            <Icon name="arrow" className="h-4 w-4 shrink-0 text-slate-400 transition-transform group-hover:translate-x-0.5" />
+          </button>
          <button
            onClick={() => void logout()}
            className="mt-3 w-full rounded-lg px-3 py-2 text-sm font-medium text-slate-600 transition-colors hover:bg-slate-100 hover:text-slate-900"
@@ -105,18 +121,31 @@ export function AppLayout(): ReactNode {
            aria-label="Menü öffnen"
            aria-expanded={mobileMenuOpen}
          >
-            <span aria-hidden="true" className="text-xl">☰</span>
+            <Icon name="menu" className="h-5 w-5" />
          </button>
-          <span className="hidden text-sm text-slate-500 lg:block">
-            Management-Plattform
-          </span>
+          <span className="hidden text-sm text-slate-500 lg:block">Management-Plattform</span>
          <span className="text-sm text-slate-500 lg:hidden">MPM</span>
+          <button
+            type="button"
+            role="switch"
+            aria-checked={darkMode}
+            aria-label="Darkmode"
+            onClick={() => setDarkMode((current) => !current)}
+            className="inline-flex h-9 items-center gap-2 rounded-lg border border-slate-200 px-3 text-sm text-slate-600 transition-colors hover:bg-slate-100"
+          >
+            <Icon name={darkMode ? 'sun' : 'moon'} className="h-4 w-4" />
+            <span>{darkMode ? 'Hell' : 'Dunkel'}</span>
+            <span className={`relative h-5 w-9 rounded-full transition-colors ${darkMode ? 'bg-brand-600' : 'bg-slate-300'}`}>
+              <span className={`absolute top-0.5 h-4 w-4 rounded-full bg-white transition-transform ${darkMode ? 'translate-x-4' : 'translate-x-0.5'}`} />
+            </span>
+          </button>
        </header>

        <main className="flex-1 overflow-y-auto p-4 lg:p-8">
          <Outlet />
        </main>
      </div>
+      {profileOpen && <ProfilePage onClose={() => setProfileOpen(false)} />}
    </div>
  );
-}
+}
--- a/apps/platform-frontend/src/components/route-guards.tsx
+++ b/apps/platform-frontend/src/components/route-guards.tsx
@@ -13,7 +13,7 @@ export function RequireAuth({ children }: { children: ReactNode }): ReactNode {
  }

  if (status === 'unauthenticated') {
-    return <Navigate to="/login" replace state={{ from: location.pathname }} />;
+    return <Navigate to="/login" replace state={{ from: location.pathname + location.search }} />;
  }

  return children;
@@ -32,4 +32,4 @@ export function RequireAdmin({ children }: { children: ReactNode }): ReactNode {
  }

  return children;
-}
+}
--- a/apps/platform-frontend/src/components/ui/card.tsx
+++ b/apps/platform-frontend/src/components/ui/card.tsx
@@ -9,7 +9,7 @@ export interface CardProps {
 export function Card({ children, className = '' }: CardProps): ReactNode {
  return (
    <div
-      className={`rounded-xl border border-slate-200 bg-white shadow-sm ${className}`}
+      className={`rounded-2xl border border-slate-200 bg-white shadow-sm ${className}`}
    >
      {children}
    </div>
@@ -25,7 +25,7 @@ export interface CardHeaderProps {
 /** Karten-Kopf mit Titel, Beschreibung und optionalen Aktionen. */
 export function CardHeader({ title, description, children }: CardHeaderProps): ReactNode {
  return (
-    <div className="flex items-start justify-between gap-4 border-b border-slate-200 px-6 py-4">
+    <div className="flex items-start justify-between gap-4 border-b border-slate-200 px-5 py-4">
      <div>
        <h2 className="text-base font-semibold text-slate-900">{title}</h2>
        {description && <p className="mt-0.5 text-sm text-slate-500">{description}</p>}
@@ -42,5 +42,5 @@ export interface CardBodyProps {

 /** Karten-Inhalt. */
 export function CardBody({ children, className = '' }: CardBodyProps): ReactNode {
-  return <div className={`px-6 py-4 ${className}`}>{children}</div>;
-}
+  return <div className={`px-5 py-5 ${className}`}>{children}</div>;
+}
--- a/apps/platform-frontend/src/components/ui/icon.tsx
+++ b/apps/platform-frontend/src/components/ui/icon.tsx
@@ -0,0 +1,36 @@
+import { type ReactNode } from 'react';
+
+export type IconName = 'dashboard' | 'users' | 'modules' | 'system' | 'audit' | 'moon' | 'sun' | 'user' | 'arrow' | 'close' | 'menu' | 'plus' | 'check';
+
+const PATHS: Record<IconName, ReactNode> = {
+  dashboard: <><rect x="3" y="3" width="7" height="7" rx="1.5" /><rect x="14" y="3" width="7" height="7" rx="1.5" /><rect x="3" y="14" width="7" height="7" rx="1.5" /><rect x="14" y="14" width="7" height="7" rx="1.5" /></>,
+  users: <><path d="M16 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2" /><circle cx="10" cy="7" r="4" /><path d="M20 21v-2a4 4 0 0 0-3-3.87M16 3.13a4 4 0 0 1 0 7.75" /></>,
+  modules: <><rect x="3" y="3" width="8" height="8" rx="2" /><rect x="13" y="3" width="8" height="5" rx="2" /><rect x="13" y="10" width="8" height="11" rx="2" /><rect x="3" y="13" width="8" height="8" rx="2" /></>,
+  system: <><path d="M12 8v4l2.5 2.5" /><circle cx="12" cy="12" r="9" /><path d="M12 3v2m9 7h-2M5 12H3m9 9v-2" /></>,
+  audit: <><path d="M8 4h10a2 2 0 0 1 2 2v14H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2Z" /><path d="M8 2v4m0 4h8m-8 4h8m-8 4h5" /></>,
+  moon: <path d="M20.9 13A9 9 0 0 1 11 3.1 9 9 0 1 0 20.9 13Z" />,
+  sun: <><circle cx="12" cy="12" r="4" /><path d="M12 2v2m0 16v2M4.93 4.93l1.42 1.42m11.3 11.3 1.42 1.42M2 12h2m16 0h2M4.93 19.07l1.42-1.42m11.3-11.3 1.42-1.42" /></>,
+  user: <><circle cx="12" cy="8" r="4" /><path d="M5 21a7 7 0 0 1 14 0" /></>,
+  arrow: <><path d="M5 12h14m-6-6 6 6-6 6" /></>,
+  close: <><path d="m18 6-12 12M6 6l12 12" /></>,
+  menu: <><path d="M4 6h16M4 12h16M4 18h16" /></>,
+  plus: <path d="M12 5v14M5 12h14" />,
+  check: <path d="m5 12 4 4L19 6" />,
+};
+
+export function Icon({ name, className = 'h-5 w-5' }: { name: IconName; className?: string }): ReactNode {
+  return (
+    <svg
+      aria-hidden="true"
+      className={className}
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.8"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      {PATHS[name]}
+    </svg>
+  );
+}
--- a/apps/platform-frontend/src/components/ui/modal.tsx
+++ b/apps/platform-frontend/src/components/ui/modal.tsx
@@ -7,6 +7,8 @@ export interface ModalProps {
  onClose: () => void;
  children: ReactNode;
  footer?: ReactNode;
+  panelClassName?: string;
+  hideHeader?: boolean;
 }

 /** Zugängliches Modal (Design-System): Fokus-Falle, ESC schließt. */
@@ -17,6 +19,8 @@ export function Modal({
  onClose,
  children,
  footer,
+  panelClassName = 'max-w-md',
+  hideHeader = false,
 }: ModalProps): ReactNode {
  useEffect(() => {
    if (!open) {
@@ -45,16 +49,18 @@ export function Modal({
        role="dialog"
        aria-modal="true"
        aria-label={title}
-        className="w-full max-w-md rounded-xl bg-white shadow-xl"
+        className={`w-full rounded-xl bg-white shadow-xl ${panelClassName}`}
        onClick={(event) => event.stopPropagation()}
      >
-        <div className="border-b border-slate-200 px-6 py-4">
-          <h2 className="text-base font-semibold text-slate-900">{title}</h2>
-          {description && <p className="mt-0.5 text-sm text-slate-500">{description}</p>}
-        </div>
+        {!hideHeader && (
+          <div className="border-b border-slate-200 px-6 py-4">
+            <h2 className="text-base font-semibold text-slate-900">{title}</h2>
+            {description && <p className="mt-0.5 text-sm text-slate-500">{description}</p>}
+          </div>
+        )}
        <div className="px-6 py-4">{children}</div>
        {footer && <div className="border-t border-slate-200 px-6 py-4">{footer}</div>}
      </div>
    </div>
  );
-}
+}
--- a/apps/platform-frontend/src/features/admin/audit-page.tsx
+++ b/apps/platform-frontend/src/features/admin/audit-page.tsx
@@ -76,10 +76,10 @@ export function AuditPage(): ReactNode {
  const totalPages = auditQuery.data ? Math.ceil(auditQuery.data.total / pageSize) : 0;

  return (
-    <div className="mx-auto max-w-6xl space-y-6">
+    <div className="mx-auto max-w-screen-2xl space-y-8 p-8">
      <div>
-        <h1 className="text-2xl font-bold text-slate-900">Audit-Log</h1>
-        <p className="mt-1 text-sm text-slate-500">
+        <h1 className="text-3xl font-bold text-slate-900">Audit-Log</h1>
+        <p className="mt-2 text-base text-slate-500">
          Sicherheitsrelevante Ereignisse der Plattform (neueste zuerst).
        </p>
      </div>
--- a/apps/platform-frontend/src/features/admin/modules-page.tsx
+++ b/apps/platform-frontend/src/features/admin/modules-page.tsx
@@ -1,18 +1,25 @@
 import { type ReactNode, useRef, useState } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { Button } from '../../components/ui/button';
+import { Icon } from '../../components/ui/icon';
 import { Modal } from '../../components/ui/modal';
 import { useToast } from '../../components/ui/toast';
 import { ApiError } from '../../lib/api-client';
 import {
  checkModuleHealth,
+  beginMarketplaceConnection,
+  disconnectMarketplaceProvider,
+  fetchMarketplaceRepositories,
+  fetchMarketplaceProviders,
  fetchModules,
  installModule,
+  installMarketplaceRepository,
  removeModule,
  restartModule,
  setModuleEnabled,
  startModule,
  stopModule,
+  type MarketplaceProvider,
 } from '../../lib/modules-api';
 import type { Module, ModuleStatus } from '../../lib/schemas';

@@ -43,6 +50,7 @@ function RemoveModuleModal({ module, onClose }: { module: Module; onClose: () =>
    mutationFn: () => removeModule(module.id),
    onSuccess: () => {
      void queryClient.invalidateQueries({ queryKey: ['modules'] });
+      void queryClient.invalidateQueries({ queryKey: ['marketplace-repositories'] });
      showToast('success', `Modul "${module.name}" wurde entfernt`);
      onClose();
    },
@@ -55,7 +63,7 @@ function RemoveModuleModal({ module, onClose }: { module: Module; onClose: () =>
    <Modal
      open
      title="Modul entfernen"
-      description={`Möchten Sie "${module.name}" (Version ${module.version}) wirklich entfernen? Dateien und Registrierung werden gelöscht.`}
+      description={`Möchten Sie "${module.name}" (Version ${module.version}) wirklich entfernen? App- und Datenbankcontainer sowie Dateien und Registrierung werden gelöscht. Datenvolumes bleiben für eine mögliche Neuinstallation erhalten.`}
      onClose={onClose}
    >
      {formError && (
@@ -86,6 +94,8 @@ export function ModulesPage(): ReactNode {
  const fileInputRef = useRef<HTMLInputElement>(null);
  const [selectedFile, setSelectedFile] = useState<File | null>(null);
  const [removeTarget, setRemoveTarget] = useState<Module | null>(null);
+  const [connectTarget, setConnectTarget] = useState<MarketplaceProvider['provider'] | null>(null);
+  const [connectionTab, setConnectionTab] = useState<'providers' | 'manual'>('providers');
  const [healthResults, setHealthResults] = useState<Record<string, { healthy: boolean; detail: string }>>({});

  const modulesQuery = useQuery({
@@ -93,6 +103,45 @@ export function ModulesPage(): ReactNode {
    queryFn: fetchModules,
    refetchInterval: 15_000,
  });
+  const marketplaceQuery = useQuery({
+    queryKey: ['marketplace-providers'],
+    queryFn: fetchMarketplaceProviders,
+  });
+  const connectedProviders = marketplaceQuery.data?.filter((item) => item.connected) ?? [];
+  const repositoriesQuery = useQuery({
+    queryKey: ['marketplace-repositories', connectedProviders.map((item) => item.provider)],
+    queryFn: async () => Promise.all(connectedProviders.map(async (item) => ({
+      ...item,
+      repositories: await fetchMarketplaceRepositories(item.provider),
+    }))),
+    enabled: connectedProviders.length > 0,
+  });
+
+  const connectMutation = useMutation({
+    mutationFn: (provider: 'github' | 'gitea' | 'forgejo') => beginMarketplaceConnection(provider),
+    onSuccess: (authorizationUrl) => window.location.assign(authorizationUrl),
+    onError: (error) => showToast('error', error instanceof ApiError ? error.message : 'Verbindung konnte nicht gestartet werden'),
+  });
+
+  const disconnectMutation = useMutation({
+    mutationFn: (provider: 'github' | 'gitea' | 'forgejo') => disconnectMarketplaceProvider(provider),
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: ['marketplace-providers'] });
+      showToast('success', 'Forge-Verbindung getrennt');
+    },
+    onError: (error) => showToast('error', error instanceof ApiError ? error.message : 'Verbindung konnte nicht getrennt werden'),
+  });
+
+  const marketplaceInstallMutation = useMutation({
+    mutationFn: (input: { provider: MarketplaceProvider['provider']; owner: string; repository: string }) =>
+      installMarketplaceRepository(input.provider, input.owner, input.repository),
+    onSuccess: (module) => {
+      void queryClient.invalidateQueries({ queryKey: ['modules'] });
+      void queryClient.invalidateQueries({ queryKey: ['marketplace-repositories'] });
+      showToast('success', `Modul "${module.name}" wurde installiert. Zum Starten bitte „Start“ wählen.`);
+    },
+    onError: (error) => showToast('error', error instanceof ApiError ? error.message : 'Marketplace-Installation fehlgeschlagen'),
+  });

  const invalidate = (): void => {
    void queryClient.invalidateQueries({ queryKey: ['modules'] });
@@ -163,190 +212,318 @@ export function ModulesPage(): ReactNode {
  }

  return (
-    <div className="mx-auto max-w-6xl space-y-6">
+    <div className="mx-auto max-w-screen-2xl space-y-8 p-8">
      <div>
-        <h1 className="text-2xl font-bold text-slate-900">Modulverwaltung</h1>
-        <p className="mt-1 text-sm text-slate-500">
+          <h1 className="text-3xl font-bold text-slate-900">Modulverwaltung</h1>
+          <p className="mt-1 text-base text-slate-500">
          Module installieren, starten, stoppen und entfernen.
        </p>
      </div>

-      {/* Installation */}
-      <div className="rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
-        <div className="flex flex-wrap items-center gap-3">
-          <input
-            ref={fileInputRef}
-            type="file"
-            accept=".zip"
-            onChange={handleFileChange}
-            className="text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-brand-50 file:px-3 file:py-2 file:text-sm file:font-medium file:text-brand-700 hover:file:bg-brand-100"
-            aria-label="Modul-Paket (ZIP) auswählen"
-          />
-          <Button
-            disabled={!selectedFile}
-            loading={installMutation.isPending}
-            onClick={handleInstall}
-          >
-            Installieren
-          </Button>
-          <p className="text-xs text-slate-500">
-            ZIP-Paket mit module.json (Manifest). Maximal 10 MB.
-          </p>
-        </div>
-      </div>
+      {new URLSearchParams(window.location.search).get('marketplace') === 'connected' && (
+        <p role="status" className="rounded-lg border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
+          Forge-Konto wurde erfolgreich verbunden.
+        </p>
+      )}
+      {new URLSearchParams(window.location.search).get('marketplace') === 'denied' && (
+        <p role="status" className="rounded-lg border border-amber-200 bg-amber-50 px-4 py-3 text-sm text-amber-800">
+          Autorisierung wurde abgebrochen.
+        </p>
+      )}
+      {new URLSearchParams(window.location.search).get('marketplace') === 'error' && (
+        <p role="alert" className="rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {new URLSearchParams(window.location.search).get('reason') === 'session'
+            ? 'MPM konnte deine Sitzung beim OAuth-Rücksprung nicht zuordnen. Verwende vor und nach der Anmeldung dieselbe Adresse (http://127.0.0.1:8081) und starte die Verbindung erneut.'
+            : new URLSearchParams(window.location.search).get('reason') === 'callback'
+              ? 'Die OAuth-Rückgabe war unvollständig. Bitte starte die Verbindung erneut.'
+              : 'Verbindung fehlgeschlagen. Prüfe OAuth-Konfiguration und Callback-URL und starte die Verbindung erneut.'}
+        </p>
+      )}

+      <div className="space-y-6">
+      {/* Compact provider connectors */}
+      <section className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <h2 className="mb-3 text-lg font-semibold text-slate-900">Verbindungen</h2>
+        <div role="tablist" aria-label="Verbindungen und manuelle Installation" className="mb-4 flex gap-2 border-b border-slate-200">
+          <button type="button" role="tab" aria-selected={connectionTab === 'providers'} onClick={() => setConnectionTab('providers')} className={`border-b-2 px-3 py-2 text-sm font-medium transition-colors ${connectionTab === 'providers' ? 'border-brand-600 text-brand-700' : 'border-transparent text-slate-500 hover:text-slate-800'}`}>
+            Verbindungen
+          </button>
+          <button type="button" role="tab" aria-selected={connectionTab === 'manual'} onClick={() => setConnectionTab('manual')} className={`border-b-2 px-3 py-2 text-sm font-medium transition-colors ${connectionTab === 'manual' ? 'border-brand-600 text-brand-700' : 'border-transparent text-slate-500 hover:text-slate-800'}`}>
+            Manuelle Installation
+          </button>
+        </div>
+        {connectionTab === 'providers' ? (
+        <div className="grid grid-cols-1">
+          {(['github', 'gitea', 'forgejo'] as const).map((provider) => {
+            const connection = marketplaceQuery.data?.find((item) => item.provider === provider);
+            const label = connection?.label ?? (provider === 'github' ? 'GitHub' : provider === 'gitea' ? 'Gitea' : 'Forgejo');
+            const statusText = marketplaceQuery.isLoading
+              ? 'Status wird geladen…'
+              : connection?.connected
+                ? `Verbunden als ${connection.accountLogin}`
+                : connection?.configured
+                  ? 'Marketplace verbinden'
+                  : 'Nicht eingerichtet';
+            return (
+              <div key={provider} className="flex min-w-0 items-center gap-3 border-b border-slate-200 py-3 last:border-b-0">
+                <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-slate-200 bg-slate-50 text-slate-900">
+                  <ProviderMark provider={provider} />
+                </span>
+                <div className="min-w-0 flex-1">
+                  <p className="truncate text-sm font-medium text-slate-900">{label}</p>
+                  <p className="truncate text-xs text-slate-500">{statusText}</p>
+                </div>
+                {connection?.connected ? (
+                  <Button
+                    className="h-9 w-9 shrink-0 p-0"
+                    variant="secondary"
+                    size="sm"
+                    aria-label={`${label}-Verbindung trennen`}
+                    title={`${label}-Verbindung trennen`}
+                    loading={disconnectMutation.isPending && disconnectMutation.variables === provider}
+                    onClick={() => disconnectMutation.mutate(provider)}
+                  >
+                    <Icon name="check" className="h-4 w-4 text-emerald-600" />
+                  </Button>
+                ) : (
+                  <Button
+                    className="h-9 w-9 shrink-0 p-0"
+                    size="sm"
+                    aria-label={`Mit ${label} verbinden`}
+                    title={connection?.configured ? `Mit ${label} verbinden` : `OAuth-Konfiguration für ${label} fehlt`}
+                    disabled={!connection?.configured || marketplaceQuery.isLoading}
+                    loading={connectMutation.isPending && connectMutation.variables === provider}
+                    onClick={() => setConnectTarget(provider)}
+                  >
+                    <Icon name="plus" className="h-5 w-5" />
+                  </Button>
+                )}
+              </div>
+            );
+          })}
+        </div>
+        ) : (
+          <div role="tabpanel" className="flex flex-wrap items-center gap-3">
+            <input
+              ref={fileInputRef}
+              type="file"
+              accept=".zip"
+              onChange={handleFileChange}
+              className="text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-brand-50 file:px-3 file:py-2 file:text-sm file:font-medium file:text-brand-700 hover:file:bg-brand-100"
+              aria-label="Modul-Paket (ZIP) auswählen"
+            />
+            <Button disabled={!selectedFile} loading={installMutation.isPending} onClick={handleInstall}>
+              Installieren
+            </Button>
+            <p className="text-xs text-slate-500">ZIP-Paket mit module.json (Manifest). Maximal 10 MB.</p>
+          </div>
+        )}
+      </section>
      {/* Modul-Liste */}
-      <div className="overflow-x-auto rounded-xl border border-slate-200 bg-white shadow-sm">
-        <table className="w-full min-w-[760px] text-sm">
-          <thead>
+      <section className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <h2 className="mb-4 text-lg font-semibold text-slate-900">Installierte Module</h2>
+        <div className="max-h-[42rem] overflow-auto rounded-xl border border-slate-200">
+        <table className="w-full min-w-[900px] table-fixed text-sm">
+          <thead className="sticky top-0 z-10">
            <tr className="border-b border-slate-200 bg-slate-50 text-left text-xs uppercase tracking-wide text-slate-500">
-              <th className="px-4 py-3 font-semibold">Modul</th>
-              <th className="px-4 py-3 font-semibold">Status</th>
-              <th className="px-4 py-3 font-semibold">URL</th>
-              <th className="px-4 py-3 font-semibold">Aktionen</th>
+              <th className="w-[34%] px-4 py-3 font-semibold">Modul</th>
+              <th className="w-[13%] px-4 py-3 font-semibold">Status</th>
+              <th className="w-[15%] px-4 py-3 font-semibold">URL</th>
+              <th className="w-[38%] px-4 py-3 font-semibold">Aktionen</th>
            </tr>
          </thead>
          <tbody>
-            {modulesQuery.isLoading && (
-              <tr>
-                <td colSpan={4} className="px-4 py-8 text-center text-slate-500">
-                  Module werden geladen…
-                </td>
-              </tr>
-            )}
-            {modulesQuery.isError && (
-              <tr>
-                <td colSpan={4} className="px-4 py-8 text-center text-red-600">
-                  Module konnten nicht geladen werden.
-                </td>
-              </tr>
-            )}
+            {modulesQuery.isLoading && <tr><td colSpan={4} className="px-5 py-10 text-center text-slate-500">Module werden geladen…</td></tr>}
+            {modulesQuery.isError && <tr><td colSpan={4} className="px-5 py-10 text-center text-red-600">Module konnten nicht geladen werden.</td></tr>}
            {modulesQuery.data?.map((module) => (
              <tr key={module.id} className="border-b border-slate-100 last:border-0">
                <td className="px-4 py-3">
-                  <div className="font-medium text-slate-900">{module.name}</div>
-                  <div className="text-xs text-slate-500">
-                    {module.moduleId} · Version {module.version}
-                    {module.author && ` · ${module.author}`}
-                  </div>
-                  {module.description && (
-                    <div className="mt-0.5 text-xs text-slate-500">{module.description}</div>
-                  )}
+                  <div className="font-semibold text-slate-900">{module.name}</div>
+                  <div className="text-xs text-slate-500">{module.moduleId} · Version {module.version}{module.author && ` · ${module.author}`}</div>
+                  {module.description && <div className="mt-0.5 text-xs text-slate-500">{module.description}</div>}
                </td>
-                <td className="px-4 py-3">
-                  <span
-                    className={`inline-flex rounded-full px-2.5 py-0.5 text-xs font-medium ring-1 ring-inset
-                      ${
-                        statusVariant(module.status) === 'success'
-                          ? 'bg-emerald-50 text-emerald-700 ring-emerald-600/20'
-                          : statusVariant(module.status) === 'warning'
-                            ? 'bg-amber-50 text-amber-700 ring-amber-600/20'
-                            : statusVariant(module.status) === 'danger'
-                              ? 'bg-red-50 text-red-700 ring-red-600/20'
-                              : statusVariant(module.status) === 'neutral'
-                                ? 'bg-slate-100 text-slate-600 ring-slate-500/20'
-                                : 'bg-brand-50 text-brand-700 ring-brand-600/20'
-                      }`}
-                  >
-                    {module.status}
-                  </span>
-                  {healthResults[module.id] && (
-                    <div className="mt-1 text-xs text-slate-500">
-                      Health: {healthResults[module.id].healthy ? '✓' : '✕'} {healthResults[module.id].detail}
-                    </div>
-                  )}
-                </td>
-                <td className="px-4 py-3">
-                  <code className="rounded bg-slate-100 px-1.5 py-0.5 text-xs text-slate-700">
-                    /{module.slug}
-                  </code>
-                </td>
-                <td className="px-4 py-3">
-                  <div className="flex flex-wrap gap-1">
-                    {module.status !== 'RUNNING' && module.enabled && (
-                      <Button
-                        size="sm"
-                        variant="ghost"
-                        loading={
-                          lifecycleMutation.isPending &&
-                          lifecycleMutation.variables?.module.id === module.id &&
-                          lifecycleMutation.variables?.action === 'start'
-                        }
-                        onClick={() => lifecycleMutation.mutate({ module, action: 'start' })}
-                      >
-                        Start
-                      </Button>
-                    )}
-                    {(module.status === 'RUNNING' || module.status === 'STARTING') && (
-                      <Button
-                        size="sm"
-                        variant="ghost"
-                        loading={
-                          lifecycleMutation.isPending &&
-                          lifecycleMutation.variables?.module.id === module.id &&
-                          lifecycleMutation.variables?.action === 'stop'
-                        }
-                        onClick={() => lifecycleMutation.mutate({ module, action: 'stop' })}
-                      >
-                        Stop
-                      </Button>
-                    )}
-                    <Button
-                      size="sm"
-                      variant="ghost"
-                      loading={
-                        lifecycleMutation.isPending &&
-                        lifecycleMutation.variables?.module.id === module.id &&
-                        lifecycleMutation.variables?.action === 'restart'
-                      }
-                      onClick={() => lifecycleMutation.mutate({ module, action: 'restart' })}
-                    >
-                      Restart
-                    </Button>
-                    <Button
-                      size="sm"
-                      variant="ghost"
-                      onClick={() => healthMutation.mutate(module)}
-                    >
-                      Health
-                    </Button>
-                    <Button
-                      size="sm"
-                      variant="ghost"
-                      loading={
-                        lifecycleMutation.isPending &&
-                        lifecycleMutation.variables?.module.id === module.id &&
-                        (lifecycleMutation.variables?.action === 'enable' ||
-                          lifecycleMutation.variables?.action === 'disable')
-                      }
-                      onClick={() =>
-                        lifecycleMutation.mutate({
-                          module,
-                          action: module.enabled ? 'disable' : 'enable',
-                        })
-                      }
-                    >
-                      {module.enabled ? 'Disable' : 'Enable'}
-                    </Button>
-                    <Button size="sm" variant="ghost" onClick={() => setRemoveTarget(module)}>
-                      Remove
-                    </Button>
-                  </div>
+                <td className="px-4 py-3"><span className={`inline-flex rounded-full px-2.5 py-0.5 text-xs font-medium ring-1 ring-inset ${statusVariant(module.status) === 'success' ? 'bg-emerald-50 text-emerald-700 ring-emerald-600/20' : statusVariant(module.status) === 'warning' ? 'bg-amber-50 text-amber-700 ring-amber-600/20' : statusVariant(module.status) === 'danger' ? 'bg-red-50 text-red-700 ring-red-600/20' : statusVariant(module.status) === 'neutral' ? 'bg-slate-100 text-slate-600 ring-slate-500/20' : 'bg-brand-50 text-brand-700 ring-brand-600/20'}`}>{module.status}</span>
+                  {healthResults[module.id] && <div className="mt-1 text-xs text-slate-500">Health: {healthResults[module.id].healthy ? '✓' : '✕'} {healthResults[module.id].detail}</div>}
                </td>
+                <td className="px-4 py-3"><code className="rounded bg-slate-100 px-1.5 py-0.5 text-xs text-slate-700">/{module.slug}</code></td>
+                <td className="px-4 py-3"><div className="flex flex-wrap gap-1">
+                  {module.status !== 'RUNNING' && module.enabled && <Button size="sm" variant="ghost" loading={lifecycleMutation.isPending && lifecycleMutation.variables?.module.id === module.id && lifecycleMutation.variables?.action === 'start'} onClick={() => lifecycleMutation.mutate({ module, action: 'start' })}>Start</Button>}
+                  {(module.status === 'RUNNING' || module.status === 'STARTING') && <Button size="sm" variant="ghost" loading={lifecycleMutation.isPending && lifecycleMutation.variables?.module.id === module.id && lifecycleMutation.variables?.action === 'stop'} onClick={() => lifecycleMutation.mutate({ module, action: 'stop' })}>Stop</Button>}
+                  <Button size="sm" variant="ghost" loading={lifecycleMutation.isPending && lifecycleMutation.variables?.module.id === module.id && lifecycleMutation.variables?.action === 'restart'} onClick={() => lifecycleMutation.mutate({ module, action: 'restart' })}>Restart</Button>
+                  <Button size="sm" variant="ghost" onClick={() => healthMutation.mutate(module)}>Health</Button>
+                  <Button size="sm" variant="ghost" loading={lifecycleMutation.isPending && lifecycleMutation.variables?.module.id === module.id && (lifecycleMutation.variables?.action === 'enable' || lifecycleMutation.variables?.action === 'disable')} onClick={() => lifecycleMutation.mutate({ module, action: module.enabled ? 'disable' : 'enable' })}>{module.enabled ? 'Disable' : 'Enable'}</Button>
+                  <Button size="sm" variant="ghost" onClick={() => setRemoveTarget(module)}>Remove</Button>
+                </div></td>
              </tr>
            ))}
          </tbody>
        </table>
-        {modulesQuery.data?.length === 0 && (
-          <p className="px-4 py-8 text-center text-slate-500">
-            Noch keine Module installiert.
+        {modulesQuery.data?.length === 0 && <p className="px-4 py-8 text-center text-slate-500">Noch keine Module installiert.</p>}
+        </div>
+      </section>
+      </div>
+      <section className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <div className="mb-6">
+          <h2 className="text-lg font-semibold text-slate-900">Marketplace</h2>
+          <p className="mt-1 text-base text-slate-500">
+            &Ouml;ffentliche Repositories verbundener Forge-Konten. Installiere den Standard-Branch direkt; MPM pr&uuml;ft das Modulmanifest vor der Installation.
+          </p>
+        </div>
+        {connectedProviders.length === 0 && (
+          <p className="rounded-lg border border-dashed border-slate-300 px-4 py-6 text-center text-sm text-slate-500">
+            Verbinde zuerst GitHub, Gitea oder Forgejo.
          </p>
        )}
-      </div>
-
+        {repositoriesQuery.isLoading && <p className="py-4 text-sm text-slate-500">Repositories werden geladen...</p>}
+        {repositoriesQuery.isError && <p role="alert" className="py-4 text-sm text-red-600">Repositories konnten nicht geladen werden.</p>}
+        <div className="max-h-[42rem] space-y-4 overflow-y-auto pr-2">
+          {repositoriesQuery.data?.map((provider) => (
+            <div key={provider.provider}>
+              <h3 className="mb-3 text-base font-semibold text-slate-800">{provider.label}</h3>
+              {provider.repositories.length === 0 ? (
+                <p className="text-sm text-slate-500">Keine &ouml;ffentlichen Repositories gefunden.</p>
+              ) : (
+                <div className="grid gap-3 md:grid-cols-2">
+                  {provider.repositories.map((repo) => (
+                    <article key={repo.owner + '/' + repo.repository} className="flex items-center justify-between gap-3 rounded-xl border border-slate-200 p-3 transition-colors hover:border-slate-400 hover:bg-slate-50">
+                      <div className="min-w-0">
+                        <div className="flex min-w-0 items-center gap-3">
+                          <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border border-slate-200 bg-slate-50 text-slate-800"><ProviderMark provider={provider.provider} /></span>
+                          <a className="truncate text-sm font-medium text-brand-700 hover:underline" href={repo.htmlUrl} target="_blank" rel="noreferrer">
+                          {repo.owner}/{repo.repository}
+                          </a>
+                        </div>
+                        {repo.description && <p className="mt-1 line-clamp-2 text-xs text-slate-500">{repo.description}</p>}
+                        <p className="mt-1 text-xs text-slate-500">Branch: {repo.defaultBranch}</p>
+                      </div>
+                      <Button
+                        size="sm"
+                        variant={repo.installed ? 'secondary' : 'primary'}
+                        disabled={repo.installed}
+                        className={repo.installed ? '!border-emerald-600 !bg-emerald-600 !text-white hover:!bg-emerald-600 disabled:!text-white' : ''}
+                        loading={marketplaceInstallMutation.isPending && marketplaceInstallMutation.variables?.repository === repo.repository}
+                        onClick={() => marketplaceInstallMutation.mutate({ provider: provider.provider, owner: repo.owner, repository: repo.repository })}
+                      >
+                        {repo.installed ? 'Installiert' : 'Installieren'}
+                      </Button>
+                    </article>
+                  ))}
+                </div>
+              )}
+            </div>
+          ))}
+        </div>
+      </section>
      {removeTarget && (
        <RemoveModuleModal module={removeTarget} onClose={() => setRemoveTarget(null)} />
      )}
+      {connectTarget && (
+        <ConnectProviderModal
+          provider={connectTarget}
+          label={marketplaceQuery.data?.find((item) => item.provider === connectTarget)?.label ??
+            (connectTarget === 'github' ? 'GitHub' : connectTarget === 'gitea' ? 'Gitea' : 'Forgejo')}
+          loading={connectMutation.isPending}
+          onClose={() => setConnectTarget(null)}
+          onContinue={() => connectMutation.mutate(connectTarget)}
+        />
+      )}
    </div>
  );
-}
+}
+
+function ProviderMark({ provider }: { provider: 'github' | 'gitea' | 'forgejo' }): ReactNode {
+  if (provider === 'github') {
+    return (
+      <svg viewBox="0 0 24 24" className="h-6 w-6" aria-hidden="true" fill="currentColor">
+        <path d="M12 .9a11.1 11.1 0 0 0-3.51 21.63c.56.1.76-.24.76-.54v-2.08c-3.1.67-3.76-1.32-3.76-1.32-.51-1.3-1.24-1.65-1.24-1.65-1.02-.7.08-.69.08-.69 1.13.08 1.73 1.16 1.73 1.16 1 .1.95 2.17 3.64 1.54.1-.74.39-1.25.7-1.54-2.48-.28-5.09-1.24-5.09-5.52 0-1.22.44-2.22 1.16-3-.12-.29-.5-1.43.11-2.98 0 0 .95-.3 3.05 1.15a10.6 10.6 0 0 1 5.55 0c2.1-1.45 3.04-1.15 3.04-1.15.61 1.55.23 2.69.12 2.98.72.78 1.15 1.78 1.15 3 0 4.3-2.61 5.23-5.1 5.5.4.35.75 1.02.75 2.06v3.04c0 .3.2.65.77.54A11.1 11.1 0 0 0 12 .9Z" />
+      </svg>
+    );
+  }
+  if (provider === 'gitea') {
+    return <span className="text-xl font-bold tracking-tight text-orange-500" aria-hidden="true">G</span>;
+  }
+  return (
+    <svg viewBox="0 0 24 24" className="h-6 w-6 text-emerald-500" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2">
+      <path d="M4 18h16l-3-4h-4l-2-4H8l2 4H7l-3 4Zm5-10 3-4 3 4" strokeLinecap="round" strokeLinejoin="round" />
+    </svg>
+  );
+}
+
+function ConnectProviderModal({
+  provider,
+  label,
+  loading,
+  onClose,
+  onContinue,
+}: {
+  provider: MarketplaceProvider['provider'];
+  label: string;
+  loading: boolean;
+  onClose: () => void;
+  onContinue: () => void;
+}): ReactNode {
+  return (
+    <Modal
+      open
+      title={`${label} verbinden`}
+      onClose={onClose}
+      hideHeader
+      panelClassName="max-w-xl overflow-hidden rounded-[28px]"
+    >
+      <div className="relative max-h-[90vh] overflow-y-auto px-1 pb-1 pt-2">
+        <button
+          type="button"
+          aria-label="Dialog schließen"
+          onClick={onClose}
+          className="absolute right-1 top-0 rounded-full p-2 text-slate-500 transition-colors hover:bg-slate-100 hover:text-slate-900"
+        >
+          <Icon name="close" className="h-4 w-4" />
+        </button>
+
+        <div className="flex items-center justify-center gap-4 pb-5 pt-2">
+          <span className="flex h-16 w-16 items-center justify-center rounded-2xl bg-slate-900 text-white">
+            <Icon name="modules" className="h-9 w-9" />
+          </span>
+          <span className="flex gap-1.5" aria-hidden="true">
+            <span className="h-2 w-2 rounded-full bg-slate-300" />
+            <span className="h-2 w-2 rounded-full bg-slate-300" />
+            <span className="h-2 w-2 rounded-full bg-slate-300" />
+          </span>
+          <span className="flex h-16 w-16 items-center justify-center rounded-2xl border border-slate-200 bg-slate-50 text-slate-900">
+            <ProviderMark provider={provider} />
+          </span>
+        </div>
+
+        <div className="mb-6 text-center">
+          <h2 className="text-2xl font-semibold text-slate-900">{label} verbinden</h2>
+          <p className="mt-1 text-base text-slate-500">MPM möchte dein {label}-Konto mit dem Marketplace verbinden.</p>
+        </div>
+
+        <div className="space-y-4 rounded-2xl border border-slate-200 px-5 py-4 text-sm">
+          <section>
+            <h3 className="font-medium text-slate-900">Berechtigungen werden respektiert</h3>
+            <p className="mt-1 text-slate-600">
+              MPM fordert nur den Zugriff auf deine Kontoinformationen an, um die Verbindung deinem Konto zuzuordnen. Schreibzugriff wird nicht angefordert.
+            </p>
+          </section>
+          <section className="border-t border-slate-200 pt-4">
+            <h3 className="font-medium text-slate-900">Du behältst die Kontrolle</h3>
+            <p className="mt-1 text-slate-600">
+              Du kannst die Verbindung jederzeit in MPM trennen oder die App-Berechtigung in den Einstellungen von {label} widerrufen.
+            </p>
+          </section>
+          <section className="border-t border-slate-200 pt-4">
+            <h3 className="font-medium text-slate-900">Mit dieser App geteilte Daten</h3>
+            <p className="mt-1 text-slate-600">
+              MPM erhält deine Forge-Konto-ID, deinen Benutzernamen und ein Zugriffstoken. Das Token wird verschlüsselt gespeichert und nur serverseitig verwendet.
+            </p>
+          </section>
+        </div>
+
+        <Button className="mt-6 h-11 w-full rounded-full" loading={loading} onClick={onContinue}>
+          Weiter zu {label} <span aria-hidden="true">↗</span>
+        </Button>
+      </div>
+    </Modal>
+  );
+}
--- a/apps/platform-frontend/src/features/admin/settings-page.tsx
+++ b/apps/platform-frontend/src/features/admin/settings-page.tsx
@@ -1,127 +0,0 @@
-import { type FormEvent, type ReactNode, useState } from 'react';
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { apiRequest, ApiError } from '../../lib/api-client';
-import { z } from 'zod';
-import { Card, CardBody, CardHeader } from '../../components/ui/card';
-import { Input } from '../../components/ui/input';
-import { Button } from '../../components/ui/button';
-import { useToast } from '../../components/ui/toast';
-import { ErrorState, Spinner } from '../../components/ui/states';
-
-/** Einstellung (API-Vertrag /api/v1/settings). */
-const settingSchema = z.object({
-  key: z.string(),
-  value: z.string(),
-  updatedAt: z.string(),
-  updatedBy: z.string().nullable(),
-});
-
-const settingsResponseSchema = z.object({
-  settings: z.array(settingSchema),
-});
-
-/** Anzeige-Namen für Einstellungs-Schlüssel. */
-const SETTING_LABELS: Record<string, string> = {
-  'platform.name': 'Plattform-Name',
-  'platform.description': 'Beschreibung',
-  'platform.maintenance_mode': 'Wartungsmodus (true/false)',
-};
-
-/** Systemeinstellungen-Seite (nur Admin). */
-export function SettingsPage(): ReactNode {
-  const { showToast } = useToast();
-  const queryClient = useQueryClient();
-  const [editValues, setEditValues] = useState<Record<string, string>>({});
-
-  const settingsQuery = useQuery({
-    queryKey: ['settings'],
-    queryFn: async () => settingsResponseSchema.parse(await apiRequest('/api/v1/settings')),
-  });
-
-  const updateMutation = useMutation({
-    mutationFn: async (input: { key: string; value: string }) =>
-      apiRequest<{ setting: unknown }>(`/api/v1/settings/${input.key}`, {
-        method: 'PATCH',
-        body: { value: input.value },
-      }),
-    onSuccess: (_result, variables) => {
-      showToast('success', `Einstellung "${variables.key}" gespeichert`);
-      void queryClient.invalidateQueries({ queryKey: ['settings'] });
-    },
-    onError: (error) => {
-      showToast('error', error instanceof ApiError ? error.message : 'Speichern fehlgeschlagen');
-    },
-  });
-
-  function handleSubmit(event: FormEvent<HTMLFormElement>, key: string): void {
-    event.preventDefault();
-    const value = editValues[key];
-    if (value !== undefined && value.trim().length > 0) {
-      updateMutation.mutate({ key, value: value.trim() });
-    }
-  }
-
-  return (
-    <div className="mx-auto max-w-3xl space-y-6">
-      <div>
-        <h1 className="text-2xl font-bold text-slate-900">Einstellungen</h1>
-        <p className="mt-1 text-sm text-slate-500">
-          Zentrale Konfiguration der Plattform.
-        </p>
-      </div>
-
-      <Card>
-        <CardHeader title="Plattform-Einstellungen" />
-        <CardBody>
-          {settingsQuery.isLoading && <Spinner label="Einstellungen werden geladen…" />}
-          {settingsQuery.isError && (
-            <ErrorState message="Einstellungen konnten nicht geladen werden." />
-          )}
-          {settingsQuery.data && settingsQuery.data.settings.length === 0 && (
-            <p className="py-4 text-center text-sm text-slate-500">
-              Noch keine Einstellungen vorhanden. Änderungen legen sie automatisch an.
-            </p>
-          )}
-          {settingsQuery.data && settingsQuery.data.settings.length > 0 && (
-            <div className="space-y-4">
-              {settingsQuery.data.settings.map((setting) => (
-                <form
-                  key={setting.key}
-                  onSubmit={(event) => handleSubmit(event, setting.key)}
-                  className="flex items-end gap-3"
-                  noValidate
-                >
-                  <div className="flex-1">
-                    <Input
-                      label={SETTING_LABELS[setting.key] ?? setting.key}
-                      value={editValues[setting.key] ?? setting.value}
-                      onChange={(event) =>
-                        setEditValues((current) => ({
-                          ...current,
-                          [setting.key]: event.target.value,
-                        }))
-                      }
-                    />
-                    <p className="mt-1 text-xs text-slate-500">
-                      Zuletzt geändert von {setting.updatedBy ?? '–'} am{' '}
-                      {new Date(setting.updatedAt).toLocaleString('de-DE')}
-                    </p>
-                  </div>
-                  <Button
-                    type="submit"
-                    variant="secondary"
-                    loading={
-                      updateMutation.isPending && updateMutation.variables?.key === setting.key
-                    }
-                  >
-                    Speichern
-                  </Button>
-                </form>
-              ))}
-            </div>
-          )}
-        </CardBody>
-      </Card>
-    </div>
-  );
-}
--- a/apps/platform-frontend/src/features/admin/system-status-page.tsx
+++ b/apps/platform-frontend/src/features/admin/system-status-page.tsx
@@ -45,10 +45,10 @@ export function SystemStatusPage(): ReactNode {
  });

  return (
-    <div className="mx-auto max-w-4xl space-y-6">
+    <div className="mx-auto max-w-screen-2xl space-y-8 p-8">
      <div>
-        <h1 className="text-2xl font-bold text-slate-900">Systemstatus</h1>
-        <p className="mt-1 text-sm text-slate-500">
+        <h1 className="text-3xl font-bold text-slate-900">Systemstatus</h1>
+        <p className="mt-2 text-base text-slate-500">
          Zustand aller Plattform-Komponenten und Module (aktualisiert alle 30 Sekunden).
        </p>
      </div>
--- a/apps/platform-frontend/src/features/admin/user-permissions-modal.tsx
+++ b/apps/platform-frontend/src/features/admin/user-permissions-modal.tsx
@@ -1,6 +1,5 @@
 import { type ReactNode, useEffect, useState } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { Button } from '../../components/ui/button';
 import { Modal } from '../../components/ui/modal';
 import { useToast } from '../../components/ui/toast';
 import { ApiError } from '../../lib/api-client';
@@ -14,7 +13,7 @@ import type { Module, User } from '../../lib/schemas';

 /**
 * Dialog: Modul-Berechtigungen eines Benutzers verwalten.
- * Zeigt alle installierten Module mit GRANTED/DENIED-Schaltern.
+ * Zeigt alle installierten Module mit Freigabe-Checkboxen.
 */
 export function UserPermissionsModal({
  user,
@@ -84,7 +83,11 @@ export function UserPermissionsModal({
    <Modal
      open
      title="Modul-Berechtigungen"
-      description={`Zugriff von ${user.displayName} (@${user.username}) auf Module verwalten.`}
+      description={
+        user.role === 'ADMIN'
+          ? 'Administratoren haben automatisch Zugriff auf alle aktivierten Module.'
+          : `Zugriff von ${user.displayName} (@${user.username}) auf Module verwalten.`
+      }
      onClose={onClose}
    >
      {modulesQuery.isLoading || permissionsQuery.isLoading ? (
@@ -98,36 +101,47 @@ export function UserPermissionsModal({
          Noch keine Module installiert.
        </p>
      ) : (
-        <ul className="space-y-2">
-          {modulesQuery.data?.map((module) => {
-            const isGranted = grantedModuleIds.has(module.id);
-            return (
-              <li
-                key={module.id}
-                className="flex items-center justify-between rounded-lg border border-slate-200 px-4 py-3"
-              >
-                <div className="min-w-0">
-                  <p className="text-sm font-medium text-slate-900">{module.name}</p>
-                  <p className="text-xs text-slate-500">
-                    /{module.slug} · Version {module.version}
-                  </p>
-                </div>
-                <Button
-                  size="sm"
-                  variant={isGranted ? 'danger' : 'primary'}
-                  loading={
-                    toggleMutation.isPending &&
-                    toggleMutation.variables?.module.id === module.id
-                  }
-                  onClick={() => handleToggle(module)}
-                >
-                  {isGranted ? 'Entziehen' : 'Freigeben'}
-                </Button>
-              </li>
-            );
-          })}
-        </ul>
+        <div className="overflow-x-auto rounded-lg border border-slate-200">
+          <table className="w-full text-sm">
+            <thead>
+              <tr className="border-b border-slate-200 bg-slate-50 text-left text-xs uppercase tracking-wide text-slate-500">
+                <th scope="col" className="px-4 py-3 font-semibold">Modul</th>
+                <th scope="col" className="w-32 px-4 py-3 text-center font-semibold">Freigeben</th>
+              </tr>
+            </thead>
+            <tbody>
+              {modulesQuery.data?.map((module) => {
+                const isAdmin = user.role === 'ADMIN';
+                const isGranted = isAdmin || grantedModuleIds.has(module.id);
+                const isSaving =
+                  toggleMutation.isPending && toggleMutation.variables?.module.id === module.id;
+
+                return (
+                  <tr key={module.id} className="border-b border-slate-100 last:border-0">
+                    <td className="px-4 py-3">
+                      <p className="font-medium text-slate-900">{module.name}</p>
+                      <p className="text-xs text-slate-500">
+                        /{module.slug} · Version {module.version}
+                      </p>
+                    </td>
+                    <td className="px-4 py-3 text-center">
+                      <input
+                        type="checkbox"
+                        checked={isGranted}
+                        disabled={isAdmin || isSaving}
+                        aria-label={`${module.name} für ${user.displayName} freigeben`}
+                        title={isAdmin ? 'Administratoren haben automatisch Zugriff' : undefined}
+                        className="h-4 w-4 cursor-pointer accent-brand-600 disabled:cursor-not-allowed disabled:opacity-60"
+                        onChange={() => handleToggle(module)}
+                      />
+                    </td>
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
+        </div>
      )}
    </Modal>
  );
-}
+}
--- a/apps/platform-frontend/src/features/admin/users-page.tsx
+++ b/apps/platform-frontend/src/features/admin/users-page.tsx
@@ -1,4 +1,4 @@
-import { type FormEvent, type ReactNode, useState } from 'react';
+import { type FormEvent, type ReactNode, useState } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { useAuth } from '../auth/auth-context';
 import { Button } from '../../components/ui/button';
@@ -49,10 +49,10 @@ function fieldErrorsFromApi(details: Record<string, string | string[]> | undefin
  return errors;
 }

-/** Datumsformat fÃ¼r Tabellenanzeigen. */
+/** Datumsformat für Tabellenanzeigen. */
 function formatDate(isoDate: string | null): string {
  if (!isoDate) {
-    return 'â€“';
+    return '–';
  }
  return new Date(isoDate).toLocaleDateString('de-DE', {
    day: '2-digit',
@@ -118,7 +118,7 @@ function CreateUserModal({
    <Modal
      open={open}
      title="Benutzer anlegen"
-      description="Neuen Benutzer fÃ¼r die Plattform registrieren"
+      description="Neuen Benutzer für die Plattform registrieren"
      onClose={onClose}
    >
      <form onSubmit={handleSubmit} className="space-y-4" noValidate>
@@ -244,7 +244,7 @@ function EditUserModal({ user, onClose }: { user: User; onClose: () => void }):
  );
 }

-/** Formular: Passwort zurÃ¼cksetzen. */
+/** Formular: Passwort zurücksetzen. */
 function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void }): ReactNode {
  const { showToast } = useToast();
  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({});
@@ -253,7 +253,7 @@ function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void
  const resetMutation = useMutation({
    mutationFn: (input: { newPassword: string }) => resetUserPassword(user.id, input),
    onSuccess: () => {
-      showToast('success', `Passwort fÃ¼r "${user.username}" wurde zurÃ¼ckgesetzt`);
+      showToast('success', `Passwort für "${user.username}" wurde zurückgesetzt`);
      onClose();
    },
    onError: (error) => {
@@ -261,7 +261,7 @@ function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void
        setFormError(error.message);
        setFieldErrors(fieldErrorsFromApi(error.details));
      } else {
-        setFormError('Passwort konnte nicht zurÃ¼ckgesetzt werden');
+        setFormError('Passwort konnte nicht zurückgesetzt werden');
      }
    },
  });
@@ -285,8 +285,8 @@ function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void
  return (
    <Modal
      open
-      title="Passwort zurÃ¼cksetzen"
-      description={`Neues Passwort fÃ¼r @${user.username} festlegen. Der Benutzer wird von allen Sitzungen abgemeldet.`}
+      title="Passwort zurücksetzen"
+      description={`Neues Passwort für @${user.username} festlegen. Der Benutzer wird von allen Sitzungen abgemeldet.`}
      onClose={onClose}
    >
      <form onSubmit={handleSubmit} className="space-y-4" noValidate>
@@ -308,7 +308,7 @@ function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void
            Abbrechen
          </Button>
          <Button type="submit" variant="danger" loading={resetMutation.isPending}>
-            ZurÃ¼cksetzen
+            Zurücksetzen
          </Button>
        </div>
      </form>
@@ -316,7 +316,7 @@ function ResetPasswordModal({ user, onClose }: { user: User; onClose: () => void
  );
 }

-/** BestÃ¤tigungsdialog: Benutzer lÃ¶schen. */
+/** Bestätigungsdialog: Benutzer löschen. */
 function DeleteUserModal({ user, onClose }: { user: User; onClose: () => void }): ReactNode {
  const { showToast } = useToast();
  const queryClient = useQueryClient();
@@ -326,19 +326,19 @@ function DeleteUserModal({ user, onClose }: { user: User; onClose: () => void })
    mutationFn: () => deleteUser(user.id),
    onSuccess: () => {
      void queryClient.invalidateQueries({ queryKey: ['users'] });
-      showToast('success', `Benutzer "${user.username}" wurde gelÃ¶scht`);
+      showToast('success', `Benutzer "${user.username}" wurde gelöscht`);
      onClose();
    },
    onError: (error) => {
-      setFormError(error instanceof ApiError ? error.message : 'LÃ¶schen fehlgeschlagen');
+      setFormError(error instanceof ApiError ? error.message : 'Löschen fehlgeschlagen');
    },
  });

  return (
    <Modal
      open
-      title="Benutzer lÃ¶schen"
-      description={`MÃ¶chten Sie "${user.displayName}" (@${user.username}) wirklich lÃ¶schen? Dieser Vorgang kann nicht rÃ¼ckgÃ¤ngig gemacht werden.`}
+      title="Benutzer löschen"
+      description={`Möchten Sie "${user.displayName}" (@${user.username}) wirklich löschen? Dieser Vorgang kann nicht rückgängig gemacht werden.`}
      onClose={onClose}
    >
      {formError && (
@@ -355,14 +355,14 @@ function DeleteUserModal({ user, onClose }: { user: User; onClose: () => void })
          loading={deleteMutation.isPending}
          onClick={() => deleteMutation.mutate()}
        >
-          EndgÃ¼ltig lÃ¶schen
+          Endgültig löschen
        </Button>
      </div>
    </Modal>
  );
 }

-/** Benutzerverwaltung (nur Admin): Liste, Anlegen, Bearbeiten, Passwort, LÃ¶schen. */
+/** Benutzerverwaltung (nur Admin): Liste, Anlegen, Bearbeiten, Passwort, Löschen. */
 export function UsersPage(): ReactNode {
  const { user: currentUser } = useAuth();
  const queryClient = useQueryClient();
@@ -390,11 +390,11 @@ export function UsersPage(): ReactNode {
  });

  return (
-    <div className="mx-auto max-w-6xl space-y-6">
+    <div className="mx-auto max-w-screen-2xl space-y-8 p-8">
      <div className="flex flex-wrap items-center justify-between gap-3">
        <div>
-          <h1 className="text-2xl font-bold text-slate-900">Benutzerverwaltung</h1>
-          <p className="mt-1 text-sm text-slate-500">
+          <h1 className="text-3xl font-bold text-slate-900">Benutzerverwaltung</h1>
+          <p className="mt-2 text-base text-slate-500">
            Benutzer anlegen, bearbeiten und verwalten.
          </p>
        </div>
@@ -416,7 +416,7 @@ export function UsersPage(): ReactNode {
            {usersQuery.isLoading && (
              <tr>
                <td colSpan={5} className="px-4 py-8 text-center text-slate-500">
-                  Benutzer werden geladenâ€¦
+                  Benutzer werden geladen…
                </td>
              </tr>
            )}
@@ -431,9 +431,7 @@ export function UsersPage(): ReactNode {
              <tr key={user.id} className="border-b border-slate-100 last:border-0">
                <td className="px-4 py-3">
                  <div className="font-medium text-slate-900">{user.displayName}</div>
-                  <div className="text-xs text-slate-500">
-                    @{user.username} Â· {user.email}
-                  </div>
+                  <div className="text-xs text-slate-500">@{user.username}</div>
                </td>
                <td className="px-4 py-3">
                  <span
@@ -444,7 +442,7 @@ export function UsersPage(): ReactNode {
                          : 'bg-slate-100 text-slate-600 ring-slate-500/20'
                      }`}
                  >
-                    {user.role === 'ADMIN' ? 'Administrator' : 'Benutzer'}
+                    {user.role === 'ADMIN' ? 'Admin' : 'Benutzer'}
                  </span>
                </td>
                <td className="px-4 py-3">
@@ -485,7 +483,7 @@ export function UsersPage(): ReactNode {
                          {user.isActive ? 'Deaktivieren' : 'Aktivieren'}
                        </Button>
                        <Button size="sm" variant="ghost" onClick={() => setDeleteTarget(user)}>
-                          LÃ¶schen
+                          Löschen
                        </Button>
                      </>
                    )}
--- a/apps/platform-frontend/src/features/auth/auth-context.tsx
+++ b/apps/platform-frontend/src/features/auth/auth-context.tsx
@@ -6,7 +6,7 @@ import {
  useMemo,
  useState,
 } from 'react';
-import { apiRequest, setUnauthorizedHandler } from '../../lib/api-client';
+import { ApiError, apiRequest, setUnauthorizedHandler } from '../../lib/api-client';
 import { authUserSchema, type AuthUser } from '../../lib/schemas';

 /** Zustand des Auth-Contexts. */
@@ -48,9 +48,26 @@ export function AuthProvider({ children }: { children: ReactNode }): ReactNode {
  }, []);

  useEffect(() => {
+    let sessionCheck: Promise<void> | null = null;
    setUnauthorizedHandler(() => {
-      setUser(null);
-      setStatus('unauthenticated');
+      if (sessionCheck) return;
+
+      sessionCheck = apiRequest<{ user: unknown }>('/api/v1/auth/me')
+        .then((response) => {
+          const currentUser = authUserSchema.parse(response.user);
+          setUser(currentUser);
+          setStatus('authenticated');
+        })
+        .catch((error: unknown) => {
+          if (error instanceof ApiError && error.status === 401) {
+            setUser(null);
+            setStatus('unauthenticated');
+          }
+          // Network errors and server errors do not prove the session expired.
+        })
+        .finally(() => {
+          sessionCheck = null;
+        });
    });
    return () => setUnauthorizedHandler(() => undefined);
  }, []);
@@ -89,4 +106,4 @@ export function useAuth(): AuthContextValue {
    throw new Error('useAuth muss innerhalb von AuthProvider verwendet werden');
  }
  return context;
-}
+}
--- a/apps/platform-frontend/src/features/dashboard/dashboard-page.tsx
+++ b/apps/platform-frontend/src/features/dashboard/dashboard-page.tsx
@@ -7,6 +7,7 @@ import { healthSchema, type Health } from '../../lib/schemas';
 import { Card, CardBody, CardHeader } from '../../components/ui/card';
 import { Badge } from '../../components/ui/badge';
 import { EmptyState, ErrorState, Spinner } from '../../components/ui/states';
+import { Icon } from '../../components/ui/icon';

 /** Dashboard: Begrüßung, eigene Anwendungen (nach Berechtigungen) und Systemstatus. */
 export function DashboardPage(): ReactNode {
@@ -28,12 +29,12 @@ export function DashboardPage(): ReactNode {
  });

  return (
-    <div className="mx-auto max-w-6xl space-y-6">
+    <div className="mx-auto max-w-screen-2xl space-y-8 p-8">
      <div>
-        <h1 className="text-2xl font-bold text-slate-900">
-          Willkommen, {user?.displayName} 👋
+        <h1 className="text-3xl font-bold text-slate-900">
+          Willkommen, {user?.displayName}
        </h1>
-        <p className="mt-1 text-sm text-slate-500">
+        <p className="mt-2 text-base text-slate-500">
          Ihre zentrale Anlaufstelle für alle freigegebenen Anwendungen.
        </p>
      </div>
@@ -56,7 +57,7 @@ export function DashboardPage(): ReactNode {
            <EmptyState
              title="Noch keine Module freigegeben"
              description="Sobald der Administrator Ihnen Module zugewiesen hat, erscheinen diese hier als Kacheln."
-              icon={<span className="text-3xl" aria-hidden="true">🧩</span>}
+              icon={<Icon name="modules" className="h-8 w-8 text-slate-500" />}
            />
          )}
          {modulesQuery.data && modulesQuery.data.length > 0 && (
@@ -65,10 +66,10 @@ export function DashboardPage(): ReactNode {
                <a
                  key={module.id}
                  href={`/${module.slug}`}
-                  className="group rounded-xl border border-slate-200 p-5 transition-colors hover:border-brand-300 hover:bg-brand-50/50"
+                  className="mpm-module-tile group rounded-xl border border-slate-200 p-5 transition-all duration-150 hover:-translate-y-0.5 hover:border-slate-400 hover:bg-slate-50 hover:shadow-md"
                >
                  <div className="flex items-start justify-between">
-                    <span className="text-2xl" aria-hidden="true">🧩</span>
+                    <Icon name="modules" className="h-6 w-6 text-slate-500" />
                    <Badge variant={module.status === 'RUNNING' ? 'success' : 'neutral'}>
                      {module.status === 'RUNNING' ? 'Verfügbar' : module.status}
                    </Badge>
@@ -77,11 +78,11 @@ export function DashboardPage(): ReactNode {
                    {module.name}
                  </h3>
                  {module.description && (
-                    <p className="mt-1 text-sm text-slate-500">{module.description}</p>
+                    <p className="mt-2 text-base text-slate-500">{module.description}</p>
                  )}
                  <span className="mt-4 inline-flex items-center gap-1 text-sm font-medium text-brand-600">
                    Öffnen
-                    <span aria-hidden="true" className="transition-transform group-hover:translate-x-0.5">→</span>
+                    <Icon name="arrow" className="h-4 w-4 transition-transform group-hover:translate-x-0.5" />
                  </span>
                </a>
              ))}
@@ -150,4 +151,4 @@ function StatusRow({
      <Badge variant={variant}>{status}</Badge>
    </div>
  );
-}
+}
--- a/apps/platform-frontend/src/features/profile/profile-page.tsx
+++ b/apps/platform-frontend/src/features/profile/profile-page.tsx
@@ -3,36 +3,26 @@ import { useMutation, useQuery } from '@tanstack/react-query';
 import { Button } from '../../components/ui/button';
 import { Card, CardBody, CardHeader } from '../../components/ui/card';
 import { Input } from '../../components/ui/input';
+import { Modal } from '../../components/ui/modal';
 import { useToast } from '../../components/ui/toast';
 import { ApiError } from '../../lib/api-client';
 import { changePassword, fetchProfile } from '../../lib/users-api';
 import { changePasswordSchema } from '../../lib/schemas';

-/** Datumsformat für Profilanzeigen. */
 function formatDate(isoDate: string | null): string {
-  if (!isoDate) {
-    return '–';
-  }
+  if (!isoDate) return '–';
  return new Date(isoDate).toLocaleDateString('de-DE', {
-    day: '2-digit',
-    month: '2-digit',
-    year: 'numeric',
-    hour: '2-digit',
-    minute: '2-digit',
+    day: '2-digit', month: '2-digit', year: 'numeric', hour: '2-digit', minute: '2-digit',
  });
 }

-/** Profil des angemeldeten Benutzers mit Passwortänderung. */
-export function ProfilePage(): ReactNode {
+/** Profilinformationen und Passwortoptionen im Dialog am Benutzernamen. */
+export function ProfilePage({ onClose }: { onClose: () => void }): ReactNode {
  const { showToast } = useToast();
  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({});
  const [formError, setFormError] = useState<string | null>(null);

-  const profileQuery = useQuery({
-    queryKey: ['profile'],
-    queryFn: fetchProfile,
-  });
-
+  const profileQuery = useQuery({ queryKey: ['profile'], queryFn: fetchProfile });
  const changePasswordMutation = useMutation({
    mutationFn: changePassword,
    onSuccess: () => {
@@ -43,9 +33,8 @@ export function ProfilePage(): ReactNode {
    onError: (error) => {
      if (error instanceof ApiError) {
        setFormError(error.message);
-        const details = error.details ?? {};
        const errors: Record<string, string> = {};
-        for (const [key, value] of Object.entries(details)) {
+        for (const [key, value] of Object.entries(error.details ?? {})) {
          errors[key] = Array.isArray(value) ? value[0] : value;
        }
        setFieldErrors(errors);
@@ -59,7 +48,6 @@ export function ProfilePage(): ReactNode {
    event.preventDefault();
    setFieldErrors({});
    setFormError(null);
-
    const formData = new FormData(event.currentTarget);
    const parsed = changePasswordSchema.safeParse({
      currentPassword: formData.get('currentPassword'),
@@ -70,9 +58,7 @@ export function ProfilePage(): ReactNode {
      const errors: Record<string, string> = {};
      for (const issue of parsed.error.issues) {
        const key = String(issue.path[0] ?? 'form');
-        if (!errors[key]) {
-          errors[key] = issue.message;
-        }
+        if (!errors[key]) errors[key] = issue.message;
      }
      setFieldErrors(errors);
      return;
@@ -80,105 +66,58 @@ export function ProfilePage(): ReactNode {
    changePasswordMutation.mutate(parsed.data);
  }

+  const profile = profileQuery.data;
  return (
-    <div className="mx-auto max-w-2xl space-y-6">
-      <div>
-        <h1 className="text-2xl font-bold text-slate-900">Mein Profil</h1>
-        <p className="mt-1 text-sm text-slate-500">
-          Ihre persönlichen Daten und Passwort-Einstellungen.
-        </p>
-      </div>
-
-      <Card>
-        <CardHeader title="Persönliche Daten" />
-        <CardBody>
-          {profileQuery.isLoading && <p className="text-sm text-slate-500">Wird geladen…</p>}
-          {profileQuery.isError && (
-            <p className="text-sm text-red-600">Profil konnte nicht geladen werden.</p>
-          )}
-          {profileQuery.data && (
-            <dl className="grid gap-4 sm:grid-cols-2">
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">Anzeigename</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  {profileQuery.data.displayName}
-                </dd>
-              </div>
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">Benutzername</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  @{profileQuery.data.username}
-                </dd>
-              </div>
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">E-Mail</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  {profileQuery.data.email}
-                </dd>
-              </div>
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">Rolle</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  {profileQuery.data.role === 'ADMIN' ? 'Administrator' : 'Benutzer'}
-                </dd>
-              </div>
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">Letzter Login</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  {formatDate(profileQuery.data.lastLoginAt)}
-                </dd>
-              </div>
-              <div>
-                <dt className="text-xs uppercase tracking-wide text-slate-500">Mitglied seit</dt>
-                <dd className="mt-1 text-sm font-medium text-slate-900">
-                  {formatDate(profileQuery.data.createdAt)}
-                </dd>
-              </div>
-            </dl>
-          )}
-        </CardBody>
-      </Card>
-
-      <Card>
-        <CardHeader
-          title="Passwort ändern"
-          description="Nach der Änderung werden alle anderen Sitzungen abgemeldet."
-        />
-        <CardBody>
-          <form onSubmit={handleSubmit} className="max-w-sm space-y-4" noValidate>
-            <Input
-              label="Aktuelles Passwort"
-              name="currentPassword"
-              type="password"
-              autoComplete="current-password"
-              error={fieldErrors.currentPassword}
-            />
-            <Input
-              label="Neues Passwort"
-              name="newPassword"
-              type="password"
-              autoComplete="new-password"
-              hint="Mindestens 10 Zeichen"
-              error={fieldErrors.newPassword}
-            />
-            <Input
-              label="Neues Passwort bestätigen"
-              name="confirmPassword"
-              type="password"
-              autoComplete="new-password"
-              error={fieldErrors.confirmPassword}
-            />
-            {formError && (
-              <p role="alert" className="rounded-lg bg-red-50 px-3 py-2 text-sm text-red-700">
-                {formError}
-              </p>
+    <Modal
+      open
+      title="Profileinstellungen"
+      description="Kontodetails und Passwort verwalten."
+      onClose={onClose}
+      panelClassName="max-w-2xl max-h-[90vh] overflow-y-auto"
+    >
+      <div className="space-y-5">
+        <Card>
+          <CardHeader title="Persönliche Daten" />
+          <CardBody>
+            {profileQuery.isLoading && <p className="text-sm text-slate-500">Wird geladen…</p>}
+            {profileQuery.isError && <p className="text-sm text-red-600">Profil konnte nicht geladen werden.</p>}
+            {profile && (
+              <dl className="grid gap-4 sm:grid-cols-2">
+                <ProfileField label="Anzeigename" value={profile.displayName} />
+                <ProfileField label="Benutzername" value={`@${profile.username}`} />
+                <ProfileField label="E-Mail" value={profile.email} />
+                <ProfileField label="Rolle" value={profile.role === 'ADMIN' ? 'Administrator' : 'Benutzer'} />
+                <ProfileField label="Letzter Login" value={formatDate(profile.lastLoginAt)} />
+                <ProfileField label="Mitglied seit" value={formatDate(profile.createdAt)} />
+              </dl>
            )}
-            <Button type="submit" loading={changePasswordMutation.isPending}>
-              Passwort ändern
-            </Button>
-          </form>
-        </CardBody>
-      </Card>
+          </CardBody>
+        </Card>
+
+        <Card>
+          <CardHeader title="Passwort ändern" description="Andere aktive Sitzungen werden danach abgemeldet." />
+          <CardBody>
+            <form onSubmit={handleSubmit} className="space-y-4" noValidate>
+              <Input label="Aktuelles Passwort" name="currentPassword" type="password" autoComplete="current-password" error={fieldErrors.currentPassword} />
+              <Input label="Neues Passwort" name="newPassword" type="password" autoComplete="new-password" hint="Mindestens 10 Zeichen" error={fieldErrors.newPassword} />
+              <Input label="Neues Passwort bestätigen" name="confirmPassword" type="password" autoComplete="new-password" error={fieldErrors.confirmPassword} />
+              {formError && <p role="alert" className="rounded-lg bg-red-50 px-3 py-2 text-sm text-red-700">{formError}</p>}
+              <div className="flex justify-end">
+                <Button type="submit" loading={changePasswordMutation.isPending}>Passwort ändern</Button>
+              </div>
+            </form>
+          </CardBody>
+        </Card>
+      </div>
+    </Modal>
+  );
+}
+
+function ProfileField({ label, value }: { label: string; value: string }): ReactNode {
+  return (
+    <div>
+      <dt className="text-xs uppercase tracking-wide text-slate-500">{label}</dt>
+      <dd className="mt-1 text-sm font-medium text-slate-900">{value}</dd>
    </div>
  );
-}
+}
--- a/apps/platform-frontend/src/index.css
+++ b/apps/platform-frontend/src/index.css
@@ -25,4 +25,54 @@
    outline: 2px solid var(--color-brand-500);
    outline-offset: 2px;
  }
-}
+}
+
+/* Graustufen-Dunkelmodus: Oberflächen bleiben anthrazit statt tiefschwarz,
+   Markenakzente werden neutral statt blau. */
+html[data-theme='dark'] {
+  color-scheme: dark;
+  --color-slate-50: #272a2d;
+  --color-slate-100: #3c4044;
+  --color-slate-200: #474b50;
+  --color-slate-300: #565b61;
+  --color-slate-400: #92979d;
+  --color-slate-500: #aeb3b9;
+  --color-slate-600: #c2c6cb;
+  --color-slate-700: #d6d9dd;
+  --color-slate-800: #e5e7eb;
+  --color-slate-900: #f3f4f6;
+  background: #272a2d;
+  color: #e5e7eb;
+}
+
+html[data-theme='dark'] body {
+  background: #272a2d;
+  color: #e5e7eb;
+}
+
+html[data-theme='dark'] .bg-white {
+  background-color: #303337;
+}
+
+html[data-theme='dark'] input,
+html[data-theme='dark'] textarea,
+html[data-theme='dark'] select {
+  background-color: #383b3f;
+  color: #f1f2f3;
+}
+
+html[data-theme='dark'] .bg-slate-900\/50 {
+  background-color: rgb(70 74 79 / 72%);
+}
+
+html[data-theme='dark'] .shadow-sm,
+html[data-theme='dark'] .shadow-xl {
+  --tw-shadow: 0 8px 24px rgb(109 114 120 / 12%);
+  box-shadow: var(--tw-shadow);
+}
+
+html[data-theme='dark'] .mpm-module-tile:hover {
+  border-color: #686d73;
+  background-color: #3b3f43;
+  box-shadow: 0 10px 24px rgb(0 0 0 / 18%);
+}
--- a/apps/platform-frontend/src/lib/api-client.ts
+++ b/apps/platform-frontend/src/lib/api-client.ts
@@ -19,13 +19,14 @@ export class ApiError extends Error {

 /** Liest das CSRF-Token aus dem nicht-HttpOnly-Cookie. */
 function readCsrfToken(): string | null {
+  let csrfToken: string | null = null;
  for (const part of document.cookie.split(';')) {
    const [name, ...value] = part.trim().split('=');
    if (name === 'mpm_csrf') {
-      return decodeURIComponent(value.join('='));
+      csrfToken = decodeURIComponent(value.join('='));
    }
  }
-  return null;
+  return csrfToken;
 }

 /** Callback, der bei einem 401-Fehler aufgerufen wird (Auth-Context setzt ihn). */
@@ -63,11 +64,14 @@ export async function apiRequest<TResponse>(
    method,
    headers,
    credentials: 'same-origin',
+    cache: 'no-store',
    body: body !== undefined ? JSON.stringify(body) : undefined,
    signal,
  });

-  if (response.status === 401 && unauthorizedHandler) {
+  // A 401 from a feature endpoint may be request-specific. Let the auth
+  // context verify the session through /auth/me before clearing the user.
+  if (response.status === 401 && path !== '/api/v1/auth/me' && unauthorizedHandler) {
    unauthorizedHandler();
  }

@@ -92,4 +96,4 @@ export async function apiRequest<TResponse>(
  }

  return (await response.json()) as TResponse;
-}
+}
--- a/apps/platform-frontend/src/lib/modules-api.ts
+++ b/apps/platform-frontend/src/lib/modules-api.ts
@@ -121,11 +121,63 @@ export async function revokeModuleAccess(userId: string, moduleId: string): Prom

 /** Liest das CSRF-Token aus dem nicht-HttpOnly-Cookie. */
 function readCsrfToken(): string | null {
+  let csrfToken: string | null = null;
  for (const part of document.cookie.split(';')) {
    const [name, ...value] = part.trim().split('=');
    if (name === 'mpm_csrf') {
-      return decodeURIComponent(value.join('='));
+      csrfToken = decodeURIComponent(value.join('='));
    }
  }
-  return null;
-}
+  return csrfToken;
+}
+
+export interface MarketplaceProvider {
+  provider: 'github' | 'gitea' | 'forgejo';
+  label: string;
+  configured: boolean;
+  connected: boolean;
+  accountLogin: string | null;
+  baseUrl: string;
+  callbackUrl: string;
+}
+
+export interface MarketplaceRepository {
+  owner: string;
+  repository: string;
+  htmlUrl: string;
+  description: string;
+  defaultBranch: string;
+  installed: boolean;
+}
+
+export async function fetchMarketplaceRepositories(provider: MarketplaceProvider['provider']): Promise<MarketplaceRepository[]> {
+  return apiRequest<MarketplaceRepository[]>(`/api/v1/marketplace/repositories/${provider}`);
+}
+
+export async function installMarketplaceRepository(
+  provider: MarketplaceProvider['provider'],
+  owner: string,
+  repository: string,
+): Promise<Module> {
+  const response = await apiRequest<{ module: unknown }>(
+    `/api/v1/marketplace/repositories/${provider}/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/install`,
+    { method: 'POST' },
+  );
+  return moduleSchema.parse(response.module);
+}
+
+export async function fetchMarketplaceProviders(): Promise<MarketplaceProvider[]> {
+  return apiRequest<MarketplaceProvider[]>('/api/v1/marketplace/providers');
+}
+
+export async function beginMarketplaceConnection(provider: MarketplaceProvider['provider']): Promise<string> {
+  const response = await apiRequest<{ authorizationUrl: string }>(
+    `/api/v1/marketplace/connections/${provider}/start`,
+    { method: 'POST' },
+  );
+  return response.authorizationUrl;
+}
+
+export async function disconnectMarketplaceProvider(provider: MarketplaceProvider['provider']): Promise<void> {
+  await apiRequest(`/api/v1/marketplace/connections/${provider}`, { method: 'DELETE' });
+}
--- a/apps/platform-frontend/src/main.tsx
+++ b/apps/platform-frontend/src/main.tsx
@@ -12,11 +12,12 @@ import { SystemStatusPage } from './features/admin/system-status-page';
 import { UsersPage } from './features/admin/users-page';
 import { ModulesPage } from './features/admin/modules-page';
 import { AuditPage } from './features/admin/audit-page';
-import { SettingsPage } from './features/admin/settings-page';
-import { ProfilePage } from './features/profile/profile-page';
 import { ForbiddenPage, NotFoundPage } from './pages/error-pages';
 import './index.css';

+document.documentElement.dataset.theme =
+  localStorage.getItem('mpm-theme') === 'dark' ? 'dark' : 'light';
+
 /** TanStack Query: keine automatischen Refetches bei Fensterfokus. */
 const queryClient = new QueryClient({
  defaultOptions: {
@@ -36,7 +37,6 @@ function AppRoutes(): ReactNode {

      <Route element={<RequireAuth><AppLayout /></RequireAuth>}>
        <Route path="/" element={<DashboardPage />} />
-        <Route path="/profile" element={<ProfilePage />} />
        <Route
          path="/admin/users"
          element={<RequireAdmin><UsersPage /></RequireAdmin>}
@@ -53,10 +53,6 @@ function AppRoutes(): ReactNode {
          path="/admin/audit"
          element={<RequireAdmin><AuditPage /></RequireAdmin>}
        />
-        <Route
-          path="/admin/settings"
-          element={<RequireAdmin><SettingsPage /></RequireAdmin>}
-        />
        <Route path="/403" element={<ForbiddenPage />} />
      </Route>

@@ -83,4 +79,4 @@ createRoot(rootElement).render(
      </BrowserRouter>
    </QueryClientProvider>
  </StrictMode>,
-);
+);